connect-uphold-login-account[.]blogspot[.]co[.]il

The domain connect-uphold-login-account.blogspot.co.il is currently active and hosts a page titled “How Can You Safely Access Your Uphold Login Account?”. The site resolves to IP 216.58.212.129, which belongs to AS15169 Google LLC and is located in the United States. DNS resolution uses Google’s authoritative nameservers (ns1‑ns4.google.com). The TLS certificate is issued by Google Trust Services under the “WE2” designation, indicating a valid HTTPS endpoint. HTTP requests return a 302 redirect, and the page is built on Blogger with additional JavaScript, Python, and OpenGSE components, supporting HTTP/3. VirusTotal has recorded 13 detections out of 95 scanners, and Google Safe Browsing classifies the URL as a social‑engineering threat. The domain appears on the PhishDestroy blocklist and on one additional security blocklist. The observed indicators point to a credential‑phishing campaign targeting users of the Uphold service, although the actual login form or data‑exfiltration mechanisms have not been publicly disclosed. Defenders should add the domain and its resolved IP to outbound filtering rules, monitor DNS queries for the domain, and ensure that any traffic to the associated IP is blocked at the network perimeter. Continuous re‑scanning is advised to capture any changes in payload or hosting infrastructure.