upholddlogin[.]blogspot[.]ch

This domain, upholddlogin.blogspot.ch, was registered through Google LLC on 21 February 2026 and is hosted on the Google infrastructure (IP 216.58.206.33, AS15169, Germany). The site returns an HTTP 302 redirect and presents the page title “Uphold | Login”. TLS is provided by Google Trust Services under the WE2 certificate, indicating a valid HTTPS endpoint. Automated analysis detected a mix of web technologies including Blogger, Java, Python, OpenGSE, Clipboard.js and support for HTTP/3, consistent with a typical content‑management platform rather than a custom phishing kit.

Google Safe Browsing classifies the URL as social engineering, and the domain appears on three independent blocklists. It is currently blocked by PhishDestroy, MetaMask and SEAL. VirusTotal reports that twelve of ninety‑five scanning engines have flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The risk rating is high and the status is listed as active.

Evidence confirms the domain is being used for credential phishing targeting users of the Uphold service, although the exact phishing page content has not been inspected. No further indicators such as malicious payloads or command‑and‑control endpoints have been observed. Defenders should block the domain at the DNS and proxy layers, enforce TLS inspection to capture the redirect, and monitor for login attempts to Uphold that originate from this host. Continuous re‑evaluation is advised, as changes to the page content or additional detections could alter the threat posture.