en-us-uphold-login[.]blogspot[.]mk

This domain, en-us-uphold-login.blogspot.mk, is actively impersonating Uphold, a digital wallet and financial services platform, as indicated by its page title 'Secure Uphold Login Guide | Manage Your Digital Wallet.' Infrastructure analysis reveals the site is hosted on Blogger infrastructure, resolving to IP address 142.250.80.33, which is associated with Google's network. The domain is registered through UNET-REG and uses an SSL certificate issued by Google Trust Services, a common tactic to lend legitimacy to phishing sites. Technologies detected include Java, Python, and OpenGSE, alongside HTTP/3, which may be used to evade traditional network-based detection mechanisms. The domain appears on one security blocklist and is flagged by 11 of 95 security vendors in a recent scan, suggesting a credible threat. Defenders should note that this domain is classified as a high-risk credential phishing site, specifically targeting users attempting to access Uphold accounts. The exact content and functionality of the site have not yet been analyzed, but the combination of impersonation, active status, and detection by security vendors warrants immediate blocking. Organizations should prioritize monitoring for connections to this domain and alert users to the risk of credential theft if interaction has occurred. No evidence currently links this domain to broader campaigns or threat actor infrastructure, but further investigation into its traffic patterns and associated indicators is recommended.