upholddlogin[.]blogspot[.]co[.]ke

The domain upholddlogin.blogspot.co.ke was registered on February 21, 2026 through Afriregister Limited and resolves to 142.251.127.132, an IP owned by Google LLC (AS15169) in Germany. DNS resolution uses Google’s public nameservers (ns1‑ns4.google.com). An HTTP 302 response is returned and the page title reported by scanners is "Uphold | Login". Google Safe Browsing classifies the site under the SOCIAL_ENGINEERING category, confirming a credential‑phishing intent. VirusTotal analysis shows 13 of 93 security vendors flag the domain as malicious. The site is listed on three public blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. Infrastructure fingerprints include Blogger hosting, Java, Python, OpenGSE, Clipboard.js, and support for HTTP/3. The SSL certificate is issued by Google Trust Services under the WE2 identifier, and Gridinsoft assigns a trust score of 0/100. Current status is active. While the exact phishing page content has not been publicly disclosed, the combination of the page title, safe‑browsing flag, and multiple vendor detections indicates a high‑risk credential‑phishing campaign targeting users of the Uphold service. Defenders should block the domain at network perimeter, update URL filtering feeds, and monitor for related login‑credential exfiltration attempts. Additional analysis of traffic to the IP and correlation with user reports is recommended to assess potential compromise.