uphold-comlogin[.]blogspot[.]it

uphold-comlogin.blogspot.it is an active credential‑phishing infrastructure observed since its registration on 21 February 2026 through MarkMonitor, Inc. The domain resolves to 142.250.201.65, an address owned by Google LLC (AS15169) located in the United States. DNS resolution uses the default Google nameservers ns1‑ns4.google.com, and the site presents a valid SSL certificate issued by Google Trust Services under the WE2 certificate profile, indicating exploitation of a legitimate hosting environment. HTTP requests receive a 302 response, and the rendered page title is “Blog not found”, suggesting that the landing page either redirects to or displays a placeholder page rather than a brand‑specific login portal. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, confirming that the attacker leveraged Google’s Blogger platform and modern web protocols.

Threat intelligence feeds have flagged the domain as credential phishing. Four independent blocking services—PhishDestroy, MetaMask, SEAL, and three additional security blocklists—currently list the domain as malicious. VirusTotal analysis reports that 14 of 95 scanning engines have identified the domain as suspicious or malicious, reinforcing the high‑risk assessment. The combination of a recent registration, use of reputable infrastructure, and active blocklist entries indicates a deliberate attempt to harvest credentials, likely targeting users who trust the “uphold‑comlogin” naming pattern.

Defenders should immediately add uphold‑comlogin.blogspot.it to URL filtering and endpoint protection policies, enforce TLS inspection to capture the 302 redirection, and monitor DNS queries to the Google nameservers for anomalous resolution patterns. Continued observation of the domain’s HTTP behavior and any changes to the page title or content is advised, as the current “Blog not found” page provides limited visibility into the phishing payload.