aucom[.]auaumx2[.]sspl[.]com[.]auwww[.]com[.]auaumx2[.]sspl[.]com[.]auwww[.]aumx2[.]sspl[.]com[.]auaumx2[.]sspl[.]com[.]au

The domain aucom.auaumx2.sspl.com.auwww.com.auaumx2.sspl.com.auwww.aumx2.sspl.com.auaumx2.sspl.com.au was observed serving an HTTP 200 response with the generic page title "Index of /". The host resolves to 185.184.154.169, an address owned by Dreamscape Networks Limited (AS38719) in Australia. The server presents a Let’s Encrypt R12 certificate, indicating the site was reachable via HTTPS at the time of capture. Nameserver delegation points to ns1.vodien.com, ns2.vodien.com, and ns3.vodien.com, consistent with the registrar Web Address Registration Pty Ltd. Google Safe Browsing has flagged the URL for social engineering, and the domain appears on a single security blocklist, where it is actively blocked by PhishDestroy.

VirusTotal analysis recorded 14 detections out of 95 scanners, reinforcing the malicious classification. Reputation services assign extremely low trust scores—Scamadviser rates the site 1/100 and Gridinsoft 0/100—reflecting the high likelihood of abuse. The domain is identified as impersonating Google, fitting a high‑risk brand‑impersonation profile.

The site is currently offline, limiting immediate observation, and no additional content details are available beyond the directory listing title. Defenders should continue to block the IP address 185.184.154.169 and the full domain string at network perimeter devices, update URL filtering lists with the observed host, and monitor the associated nameservers for any re‑activation. Analysts should also track any future registrations under the same registrar or ASN, as the infrastructure suggests a reusable hosting environment for similar campaigns.