uphold-logins[.]blogspot[.]co[.]nz

The domain uphold-logins.blogspot.co.nz is identified as a high-risk credential theft site, currently taken offline. This domain impersonates the brand Uphold, a reputable financial services platform, to deceive users into divulging sensitive login credentials.

Analysis indicates that uphold-logins.blogspot.co.nz has been flagged by 13 out of 95 VirusTotal vendors, highlighting the significant level of suspicion and potential threat associated with this domain. The domain is registered through MarkMonitor, Inc. and resolves to the IP address 74.125.200.132, which is located in Singapore (SG) and belongs to AS15169 Google LLC. The SSL certificate is issued by Google Trust Services / WE2, which may be used to gain user trust. The domain was created on September 07, 2005, and has appeared on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. These indicators suggest a well-established and potentially sophisticated phishing operation.

Currently, the domain is offline, but the risk remains due to the potential for reactivation. Security teams and users are advised to monitor for any signs of the domain becoming active again. Additionally, implementing DNS-based blocking, educating users about the dangers of credential theft, and using multi-factor authentication (MFA) can significantly mitigate the risk of falling victim to this type of attack. Organizations should also consider enhancing their incident response plans to quickly address any potential breaches related to this domain.