en-us-uphold-login[.]blogspot[.]co[.]za

PhishDestroy has identified the domain en-us-uphold-login.blogspot.co.za as a credential phishing threat, specifically a fake login page impersonating the Uphold digital wallet platform. This phishing domain was designed to steal login credentials from users seeking to manage their digital assets, and although no specific crypto drainer kit was confirmed, the site's intent was clearly malicious.

Technical analysis reveals that 14 out of 95 security vendors on VirusTotal flagged this domain as malicious, underscoring its dangerous nature. The domain was registered on February 24, 2005, through MarkMonitor, Inc., and resolves to IP address 142.250.80.97. It is currently listed on one security blocklist, and Google Safe Browsing status indicates the page was taken offline after being reported.

As of the latest check, the domain is offline, which suggests that hosting providers or law enforcement have intervened to mitigate the threat. However, users who may have visited the site before it was taken down should change their Uphold passwords and enable two-factor authentication immediately. PhishDestroy recommends always verifying the legitimacy of login pages by using official bookmarks or direct URL entry, and to check any suspicious domains on PhishDestroy before entering credentials.