com[.]auwww[.]mail7[.]sspl[.]com[.]auwww[.]aucom[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]auwww[.]sspl[.]com[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]au

Analysis of the domain com.auwww.mail7.sspl.com.auwww.aucom.aumail7.sspl.com.auwww.mail7.sspl.com.auwww.sspl.com.aumail7.sspl.com.auwww.mail7.sspl.com.au confirms a high-risk brand impersonation targeting Google, currently offline as of July 24, 2026. The domain resolves to IP 185.184.154.169 (AS38719, Dreamscape Networks Limited, Australia) and presents an HTTP 200 status with a page title 'Index of /', indicating an open directory rather than a rendered phishing page. Google Safe Browsing flags this domain for social engineering, and it appears on one security blocklist.

Detection engines from 14 of 95 vendors on VirusTotal classify the domain as malicious. Trust scores from Scamadviser (1/100) and Gridinsoft (0/100) further support its malicious classification. The domain uses nameservers ns1.vodien.com, ns2.vodien.com, and ns3.vodien.com, and is registered through Web Address Registration Pty Ltd. The SSL certificate is issued by Let's Encrypt (R12).

While the domain is offline, its infrastructure remains a potential vector for future malicious activity. Defenders should monitor for re-activation, block the domain and associated IP at perimeter controls, and investigate logs for prior connections to 185.184.154.169 or the domain itself. The exact phishing kit or payload is not confirmed in available data.