en-us-uphold-login[.]blogspot[.]sg

The domain en-us-uphold-login.blogspot.sg was registered on 2010-09-15 through MarkMonitor, Inc. and is hosted on Google’s Blogger platform using Google’s nameservers (ns1.google.com, ns2.google.com, ns3.google.com, ns4.google.com). DNS resolves to 142.251.12.132, an address owned by AS15169 Google LLC located in Singapore. The site presents a valid SSL certificate issued by Google Trust Services (WE2) and supports HTTP/3, Java, Python and OpenGSE. The page title “Secure Uphold Login Guide | Manage Your Digital Wallet” aligns with a credential‑phishing campaign targeting users of the Uphold service, classified as a crypto‑related scam. Infrastructure analysis shows no anomalous hosting patterns; the use of Google’s infrastructure is typical for many benign blogs, which complicates detection. The domain appears on one security blocklist and is flagged by PhishDestroy; 12 of 95 VirusTotal scanners have raised alerts. HTTP requests return a 302 redirect, a common technique for funneling victims to a credential‑harvesting endpoint. Publicly available intelligence does not include a payload sample, so the exact phishing content remains uncertain. Defenders should add the domain to URL filtering and sinkhole lists, monitor for similar Google‑hosted subdomains, and enforce credential‑reuse detection for Uphold‑related login attempts. Continuous re‑evaluation is advised as the site remains active.