sspl[.]com[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]au

The domain sspl.com.aumail7.sspl.com.auwww.mail7.sspl.com.au has been identified as a high-risk credential theft operation. Analysis indicates this infrastructure was designed to harvest login credentials through deceptive landing pages, likely mimicking legitimate authentication portals. The domain is currently offline, but its prior activity warrants continued monitoring due to its association with malicious campaigns. Infrastructure analysis reveals the domain was flagged by 14 of 95 security vendors on VirusTotal, indicating broad detection of its malicious intent. It resolves to the IP address 185.184.154.169, hosted under AS38719 (Dreamscape Networks Limited) in Australia. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is registered through Web Address Registration Pty Ltd. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to lend superficial legitimacy to phishing sites. The page title 'Index of /' suggests an exposed directory structure, potentially misconfigured or intentionally left accessible for malicious purposes. Current status confirms the domain has been taken offline, though residual risk remains due to the infrastructure's prior use in credential theft operations. Organizations and users are advised to block the domain and its associated IP (185.184.154.169) at the network level. Security teams should review logs for connections to this infrastructure, particularly from endpoints that may have interacted with the domain before its takedown. Proactive monitoring of similar subdomains under the sspl.com.au namespace is recommended, as threat actors frequently reuse infrastructure patterns for subsequent campaigns.