app-uphold-login[.]blogspot[.]dk

The domain app-uphold-login.blogspot.dk, previously used for credential phishing, has been taken offline. It impersonated the digital wallet service Uphold, aiming to steal user credentials. The site was flagged as malicious by 11 out of 95 vendors on VirusTotal, indicating significant detection across security platforms.

Registered through MarkMonitor, Inc., and hosted on Google's infrastructure in Germany, this domain leveraged a reputable hosting environment to gain user trust. The SSL certificate was issued by Google Trust Services, further adding a layer of perceived legitimacy to unsuspecting users. Despite its offline status, the domain's previous activity highlights the persistent threat of phishing campaigns targeting financial services.

PhishDestroy added app-uphold-login.blogspot.dk to its blocklist on December 9, 2025, reflecting its proactive approach in identifying and mitigating threats. The domain's creation date in 2011 suggests it may have been dormant or repurposed for malicious use, a common tactic in phishing operations. The early detection by PhishDestroy underscores the importance of timely threat intelligence to protect users from emerging phishing schemes.