uphld-logon-accunt[.]blogspot[.]mx

This domain, uphld-logon-accunt.blogspot.mx, is actively flagged as a high-risk credential phishing endpoint targeting users through a deceptive login simulation. Analysis indicates the domain was registered on March 2, 2026, and remains operational despite being listed on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The domain resolves to 142.251.141.129, an IP address assigned to Google LLC in the United States, and is hosted on infrastructure utilizing Blogger, Java, Python, and OpenGSE technologies. The HTTP response code 302 suggests a redirect mechanism, though the final destination remains unclear due to the current 'Blog not found' page title, which may indicate either a temporary takedown or a cloaking technique to evade detection. Infrastructure analysis reveals the domain is managed under Google’s nameservers and secured with an SSL certificate issued by Google Trust Services, leveraging the WE2 root. While the use of legitimate hosting providers and valid SSL certificates is a common tactic to lend credibility to phishing campaigns, the presence of 11 detections out of 95 security vendors on VirusTotal further corroborates its malicious classification. The combination of a 302 redirect, Google-hosted infrastructure, and blocklist inclusion suggests an attempt to exploit trusted platforms to bypass initial security filters. Defenders should treat this domain as an active threat vector for credential harvesting. Network-level blocking of the domain and its resolving IP is recommended, along with monitoring for related subdomains or redirect chains that may emerge. Given the use of Blogger, security teams should also review logs for any unusual access patterns or referrals from this domain, particularly in environments where Google services are whitelisted. The lack of a visible phishing page at the time of analysis does not diminish the risk, as the domain may reactivate or redirect to malicious content at any time.