mta[.]sspl[.]com[.]au

On July 23, 2026, analysis of the domain mta.sspl.com.au revealed a high‑risk brand‑impersonation campaign that masquerades as Google. The domain is registered through Web Address Registration Pty Ltd and uses the authoritative nameservers ns1.vodien.com, ns2.vodien.com and ns3.vodien.com. DNS resolution points to the IPv4 address 185.184.154.169, which belongs to AS38719 Dreamscape Networks Limited based in Australia. An HTTPS service is presented using a Let’s Encrypt R12 certificate, and an HTTP GET request returns a 200 status code with the page title “Index of /”, indicating an open directory listing rather than a crafted login page.

VirusTotal reports that 13 of 95 security vendors have flagged the domain, and it appears on one public blocklist. Google Safe Browsing classifies the site as a social‑engineering threat, and the PhishDestroy service has already blocked it. Gridinsoft assigns a trust score of 0 out of 100, underscoring the malicious nature of the infrastructure. The site’s current status is offline, but the observed indicators suggest that the operators can reactivate the domain or duplicate the setup on similar infrastructure.

Defenders should continue to block the domain and its associated IP address at perimeter filters, ensure that any internal DNS resolvers deny queries for this name, and monitor for re‑registration or similar sub‑domains using the same nameserver set. Additional scrutiny of outbound connections to Dreamscape Networks’ address space is advisable. Because only the directory index has been observed, the exact phishing payload remains unknown; analysts should treat any future content served from the domain as potentially malicious and apply standard credential‑theft mitigations. Continuous threat‑intel sharing with platforms such as PhishDestroy and Google Safe Browsing will help maintain up‑to‑date defenses.