en-us-uphold-login[.]blogspot[.]sn

Analysis of en-us-uphold-login.blogspot.sn indicates active credential phishing infrastructure targeting users of a digital wallet service. The domain, hosted on Blogger infrastructure, resolves to 142.250.80.97 and is registered through MarkMonitor, Inc., with a creation date of August 22, 2011. The page title, 'Secure Uphold Login Guide | Manage Your Digital Wallet,' explicitly references Uphold, suggesting an attempt to deceive users into submitting login credentials. The domain is flagged by 11 of 95 security vendors and appears on at least one security blocklist, including PhishDestroy, confirming its malicious classification. Technical indicators reveal the use of Google Trust Services for SSL certification, a common tactic to lend legitimacy to phishing pages. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, consistent with a hosted phishing kit rather than a compromised legitimate site. The domain remains active as of July 12, 2026, with no evidence of takedown or mitigation. Defenders should prioritize blocking this domain at the network and endpoint levels, particularly in environments where Uphold or similar digital wallet services are used. Further investigation into associated infrastructure, such as hosting providers or linked domains, is recommended to identify broader campaign activity. The exact content of the phishing page has not been analyzed, so additional payloads or secondary objectives cannot be ruled out.