app-uphold-login[.]blogspot[.]com[.]cy

This domain, app-uphold-login.blogspot.com.cy, is actively flagged as a credential phishing site targeting users of the Uphold platform. Analysis indicates the domain is hosted on Google LLC infrastructure (AS15169) with an IP address of 172.253.62.132, located in the US. The page title, 'Uphold Login | Secure Digital Access,' explicitly suggests an attempt to mimic the legitimate Uphold login portal, aligning with the credential phishing classification. The domain is currently active, returning an HTTP 302 redirect status, which may indicate dynamic behavior to evade detection or direct victims to a secondary malicious endpoint.

Technical indicators reveal the use of Blogger as the underlying platform, alongside detected technologies such as Java, Python, and OpenGSE. The SSL certificate is issued by Google Trust Services (WE2), which is consistent with Blogger-hosted domains but does not mitigate the phishing risk. As of the report date, the domain appears on one security blocklist (PhishDestroy), and four out of 95 security vendors on VirusTotal have flagged it as malicious. While the detection rate is relatively low, this does not guarantee safety, as phishing domains often evade initial scans through rapid rotation or obfuscation techniques.

Defenders should treat this domain as high-risk due to its active status, explicit targeting of Uphold credentials, and presence on a security blocklist. Immediate action includes blocking the domain at the DNS or proxy level, monitoring for related subdomains or IP associations, and alerting users to potential phishing attempts. Further investigation into the redirect chain and any linked infrastructure is recommended to identify additional compromised assets or threat actor patterns. The exact content of the phishing page remains unanalyzed, so defenders should avoid assumptions about visual mimicry or additional attack vectors beyond the credential harvesting intent.