connect-uphold-login[.]blogspot[.]com[.]co

This domain, connect-uphold-login.blogspot.com.co, is actively flagged as a high-risk credential phishing site targeting Uphold users. Infrastructure analysis reveals the domain is hosted on Blogger infrastructure, resolving to the IPv6 address 2607:f8b0:4004:c09::84 within AS15169 (Google LLC). The page title, 'How Can You Easily Access Uphold Login Safely?,' explicitly references Uphold, indicating an intent to deceive users into submitting login credentials. The domain was registered on July 8, 2012, but its current malicious use began recently, as evidenced by its presence on one security blocklist and detection by 9 of 95 security vendors in recent scans. The SSL certificate is issued by Google Trust Services, a common feature of legitimate and malicious sites hosted on Google platforms. The domain returns an HTTP 302 status, which may redirect victims to a secondary phishing page or serve as part of the attack chain. Technologies detected include Blogger, Java, Python, and OpenGSE, consistent with standard Blogger hosting environments. Defenders should treat this domain as an active threat, blocking it at the network level and monitoring for related infrastructure, such as redirect domains or secondary payload hosts. The exact phishing kit or backend infrastructure remains unconfirmed, but the domain's association with credential harvesting is clear. No evidence suggests compromise of legitimate Uphold infrastructure; this appears to be a standalone phishing operation.