sspl[.]com[.]auaumail7[.]sspl[.]com[.]aumail7[.]sspl[.]com[.]au

Analysis of sspl.com.auaumail7.sspl.com.aumail7.sspl.com.au shows multiple indicators of malicious activity targeting the Google brand. The site returned an HTTP 200 response with the page title "Index of /", a generic directory listing that offers no legitimate content. DNS resolution points to the IP address 185.184.154.169, which is registered to Dreamscape Networks Limited (AS38719) in Australia. The domain is registered through Web Address Registration Pty Ltd and uses three Vodien nameservers (ns1.vodien.com, ns2.vodien.com, ns3.vodien.com).

A Let’s Encrypt R12 certificate was observed, indicating the presence of TLS but offering no authentication of the site owner. Google Safe Browsing flags the URL for social engineering, and the domain appears on one security blocklist. VirusTotal recorded 15 detections out of 95 scanned vendors, reinforcing the suspicion of abuse. Additional telemetry includes a Gridinsoft trust score of 0 out of 100 and a block entry from PhishDestroy.

The infrastructure is currently offline, but the historical evidence suggests the domain was used to impersonate Google, likely as part of a credential‑harvesting campaign. Uncertainty remains regarding the exact payload or phishing kit employed, as no page content beyond the directory index has been captured. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat‑intel feeds with the observed indicators, and monitor the associated IP and nameserver infrastructure for any re‑activation. Incident response teams encountering traffic to this host should treat it as malicious, isolate affected endpoints, and enforce credential resets for any Google accounts potentially exposed.