docs-uphold-wallet[.]blogspot[.]com[.]es

Analysis indicates that docs-uphold-wallet.blogspot.com.es is an active crypto drainer scam domain, first registered on February 21, 2026. Infrastructure analysis reveals the domain resolves to 142.250.185.65, hosted on Google LLC's network (AS15169) in the United States. The domain is currently flagged by 14 of 93 security vendors on VirusTotal, with detections explicitly classifying it as a crypto scam. It appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, further corroborating its malicious classification.

The domain is hosted on Blogger infrastructure, with detected technologies including Java, Python, and OpenGSE, alongside HTTP/3 support. The SSL certificate is issued by Google Trust Services (WE2), consistent with Blogger's hosting environment. Despite the page title displaying 'Blog not found,' the HTTP status returns a 302 redirect, suggesting the domain may be configured to forward visitors to malicious endpoints or serve content dynamically. The absence of visible content does not diminish the risk, as crypto drainers often employ transient or conditional payload delivery.

Defenders should treat this domain as high-risk infrastructure. The combination of crypto-specific detections, blocklist presence, and association with known crypto drainer activity warrants immediate blocking at the network and endpoint levels. Security teams are advised to monitor for connections to 142.250.185.65 and the domain itself, particularly in environments handling cryptocurrency transactions. Given the domain's recent registration and active status, continued monitoring for related infrastructure or rebranding attempts is recommended.