uphold-loginaccount[.]blogspot[.]com[.]tr

The domain uphold-loginaccount.blogspot.com.tr is currently active and classified as a high‑risk credential phishing site targeting Uphold users. The page title observed, "How Can You Securely Access Your Uphold Login Account?", directly references the targeted brand and aligns with the credential phishing scam type recorded in the intelligence. Infrastructure analysis shows the domain resolves to IP 142.250.186.161, which belongs to AS15169 owned by Google LLC and is located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE2 designation, confirming the use of a legitimate Google‑managed certificate chain.

HTTP monitoring indicates a 302 redirect response, suggesting the site may forward visitors to additional malicious endpoints after the initial request. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, consistent with a content‑hosting platform that leverages modern web protocols. The domain appears on the PhishDestroy blocklist, providing at least one external confirmation of malicious activity. VirusTotal scans have flagged the domain by 12 of 95 security vendors, reinforcing the suspicion of abuse.

While the presence of a Blogger environment and the observed technologies give confidence in the attribution, the exact phishing infrastructure—such as the final landing page, credential collection method, or any backend command‑and‑control servers—remains unverified due to limited public visibility. Defenders should block the domain at network perimeters, update URL filtering policies, and monitor for DNS queries to 142.250.186.161. Endpoint protection solutions should be configured to flag any credential submissions to Uphold‑related URLs originating from this host. Continuous re‑scanning of the domain on VirusTotal and inclusion in threat‑intel feeds are recommended to capture any future changes in its behavior or hosting configuration.