com[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]aucom[.]auwww[.]mail7[.]sspl[.]com[.]auwww[.]sspl[.]com[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]au

Analysis of the domain com.aumail7.sspl.com.auwww.mail7.sspl.com.aucom.auwww.mail7.sspl.com.auwww.sspl.com.aumail7.sspl.com.auwww.mail7.sspl.com.au reveals a high‑risk Google brand impersonation operation. Registration was handled by Web Address Registration Pty Ltd and the domain is served by the nameservers ns1.vodien.com, ns2.vodien.com, and ns3.vodien.com. DNS resolution points to IP address 185.184.154.169, which belongs to AS38719 Dreamscape Networks Limited and is geolocated in Australia. The web server presents a Let’s Encrypt R12 TLS certificate and responds with HTTP status 200, delivering a page titled “Index of /”, indicating a default directory listing rather than a custom landing page.

Google Safe Browsing flags the host for social engineering, and VirusTotal reports that 14 of 95 scanning engines have flagged the domain, confirming malicious intent. The site is listed on one security blocklist and has been actively blocked by PhishDestroy. Reputation metrics are extremely low, with Gridinsoft assigning a score of 0/100 and Scamadviser a rating of 1/100. The domain’s current status is offline, suggesting removal or takedown.

While the exact content of the site has not been captured, the combination of a complex sub‑domain structure, the explicit Google brand target, and multiple independent detections strongly indicate credential‑stealing activity. Defenders should continue to block the associated IP address and all observed hostnames, incorporate the full sub‑domain pattern into URL filtering rules, and monitor the ISP’s address range for similar constructs. Further analysis should target any residual DNS entries or cached snapshots that could reveal the original phishing payload. Until definitive clean evidence emerges, the domain should be treated as malicious.