sspl[.]com[.]auaucom[.]ausspl[.]com[.]aumail7[.]sspl[.]com[.]aumail7[.]sspl[.]com[.]au

The domain sspl.com.auaucom.ausspl.com.aumail7.sspl.com.aumail7.sspl.com.au was observed serving an HTTP 200 response with the generic directory listing page title “Index of /”. Technical inspection shows the host resolves to IP address 185.184.154.169, which belongs to the Australian ASN 38719 operated by Dreamscape Networks Limited. The server presents a valid Let’s Encrypt certificate (R12) matching the public‑facing host name, indicating that TLS encryption was deliberately provisioned. Nameserver delegation points to ns1.vodien.com, ns2.vodien.com and ns3.vodien.com, a set frequently associated with disposable or short‑lived hosting services.

VirusTotal records indicate that 13 of 95 scanned security vendors flagged the domain, while Google Safe Browsing classifies it as a social‑engineering threat. Gridinsoft assigned a trust score of zero out of one hundred, and the domain appears on a single external blocklist, where it has already been added to PhishDestroy’s sink‑hole. The registrar listed is Web Address Registration Pty Ltd, a commercial Australian registrar. The site is currently taken offline, but historical evidence confirms it was used to impersonate Google, a high‑value brand.

Because the domain leveraged legitimate TLS, a trusted certificate authority, and a public‑facing directory index, automated detection may have been challenged. Defenders should continue to block the IP 185.184.154.169 at network perimeters, add the full domain to URL filtering and email gateway blocklists, and monitor for any future sub‑domains that reuse the same nameserver set or ASN. Threat‑intel teams should also flag the associated nameservers and registrar for heightened scrutiny, as they have been used in other brand‑impersonation campaigns. Continuous re‑scanning with multi‑vendor services is advised to capture any changes in detection status before the domain potentially resurfaces.