connect-uphold-login[.]blogspot[.]com[.]tr

The domain connect-uphold-login.blogspot.com.tr is currently active and hosts a credential phishing page titled "How Can You Easily Access Uphold Login Safely?". DNS resolution points to IP 142.250.185.129, which belongs to AS15169 operated by Google LLC and is located in the United States. The site presents a 302 HTTP response and serves content over HTTPS using a Google Trust Services certificate (WE2). Automated fingerprinting identified the use of Blogger as the primary CMS along with server‑side components written in Java and Python, the OpenGSE library, and support for HTTP/3. The page has been flagged by six of ninety‑five VirusTotal scanners and is listed on one external blocklist; it is also blocked by the PhishDestroy mitigation service. While the page title explicitly references Uphold, no additional content analysis is available, so the exact phishing flow and any credential harvesting mechanisms remain unconfirmed. Defenders should treat any traffic to this host as malicious, block the domain at network perimeters, and monitor for related indicators such as the associated IP address and the observed SSL certificate fingerprint. Continuous re‑evaluation is advised, as the infrastructure may evolve or be leveraged for further credential‑stealing campaigns.