sspl[.]com[.]auwww[.]aucom[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]auwww[.]sspl[.]com[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]au

The domain sspl.com.au and its associated subdomains, including mail7.sspl.com.au, have been identified as part of a generic credential phishing infrastructure. This threat type focuses on harvesting user login credentials through deceptive web pages designed to mimic legitimate services. Analysis indicates no specific brand impersonation, but the infrastructure exhibits characteristics typical of broad-scale phishing campaigns. The domains are currently offline, though prior activity suggests a risk of reactivation or migration to new endpoints. Infrastructure analysis reveals the following technical indicators: the domains were flagged by 13 of 95 security vendors on VirusTotal, indicating widespread detection. The registrar of record is Web Address Registration Pty Ltd, and the infrastructure resolved to the IP address 185.184.154.169. The SSL certificate was issued by Let’s Encrypt, a common choice for both legitimate and malicious actors due to its accessibility. The domains appear on two security blocklists, specifically PhishDestroy and PhishingDB, and received a trust score of 0/100 from Gridinsoft. The page title observed during active periods was 'Index of /', suggesting an exposed directory listing or misconfigured server, which is often exploited in phishing operations to host malicious content. Current status confirms the infrastructure is offline, though the risk of re-emergence remains elevated. Organizations and individuals are advised to implement the following mitigations: block the IP address 185.184.154.169 at the network perimeter, monitor for any reactivation of the domains or subdomains, and update endpoint protection rules to include known indicators of compromise. Users should be trained to recognize generic phishing attempts, particularly those leveraging exposed directory listings or unexpected login prompts. Security teams are encouraged to review logs for prior connections to the identified IP or domains to assess potential exposure.