connect-uphold-login[.]blogspot[.]com[.]mt

This domain, connect-uphold-login.blogspot.com.mt, is actively flagged as a high-risk credential phishing site targeting users of the Uphold platform. Analysis indicates the domain is still operational as of July 12, 2026, with an HTTP 302 redirect status, suggesting it may be dynamically routing victims to malicious endpoints. The domain resolves to 142.250.185.65, an IP address hosted on Google LLC’s infrastructure (AS15169), which is consistent with the use of Blogger as the underlying platform. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to phishing pages. The page title, 'How Can You Easily Access Uphold Login Safely?', explicitly references Uphold, a cryptocurrency exchange, indicating the intended target. While the exact content of the phishing page remains unconfirmed, the title suggests an attempt to deceive users into entering credentials under the guise of secure access. The domain appears on one security blocklist and is flagged by 12 out of 95 security vendors on VirusTotal, reinforcing its classification as malicious. A Scamadviser trust score of 1/100 further corroborates the high-risk assessment. Technical indicators reveal the use of Blogger, Java, Python, and OpenGSE, which may facilitate the delivery of phishing content or evasion of detection. The presence of HTTP/3 suggests modern infrastructure, potentially complicating mitigation efforts. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where Uphold or similar financial services are accessed. Users should be alerted to the threat, and any credentials entered on this domain should be considered compromised. Given the domain’s active status and clear targeting of Uphold, organizations handling cryptocurrency or financial data should treat this as an immediate threat and monitor for related phishing campaigns.