sspl[.]com[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]aucom[.]auwww[.]mail7[.]sspl[.]com[.]auwww[.]sspl[.]com[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]au

This report details a high-risk generic phishing threat targeting users through the domain sspl.com.au and its subdomains, including mail7.sspl.com.au and www.mail7.sspl.com.au. The phishing campaign does not impersonate a specific brand and no drainer kit was identified, but the infrastructure is actively used for credential theft. The threat was flagged by Google Safe Browsing as phishing and appears on two security blocklists, indicating widespread recognition of its malicious nature.

Technical indicators reveal that the domain resolves to IP address 185.184.154.169 and is registered through Web Address Registration Pty Ltd. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, underscoring its high-risk profile. The SSL certificate is issued by Let's Encrypt / R12, and the page title found was "Index of /," suggesting a directory listing that could expose additional malicious files. The domain was registered with a unique seed identifier 0b34cb, and its current status is offline.

As of the latest analysis, the domain has been taken offline, likely due to security vendor takedowns or registrar intervention. However, residual risk remains as the infrastructure could be reactivated or reused for similar attacks. Users should remain vigilant against unexpected emails or links from sspl.com.au or its subdomains. PhishDestroy recommends avoiding interaction with any related URLs and reporting suspicious messages. Regular monitoring and updating of security blocklists are advised to mitigate future threats.