uphold-login-en[.]blogspot[.]com[.]eg

The domain uphold-login-en.blogspot.com.eg is currently active and has been classified as a credential phishing site targeting users of the Uphold financial service. The site presents the page title “Uphold Login - Secure Access to Your Financial Accounts,” which aligns with the observed scam type. Analysis shows the domain resolves to the IPv6 address 2a00:1450:4001:828::2001 and returns an HTTP 302 status code, indicating a redirection mechanism typical of phishing infrastructure.

The underlying infrastructure is hosted by Google LLC, as indicated by the IP location in Germany (DE) and ASN 15169. The SSL certificate is issued by Google Trust Services under the WE2 designation, confirming the use of legitimate TLS certificates to lend credibility. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, suggesting the site leverages common web‑application platforms rather than a specialized phishing kit.

Reputation data shows the domain is listed on a single security blocklist and has been blocked by the PhishDestroy mitigation system. VirusTotal scans have flagged the domain by 14 out of 95 security vendors, reflecting a moderate level of consensus regarding its malicious nature. The presence of only one public blocklist entry may indicate limited exposure or recent deployment, while the vendor detections provide corroborating evidence of phishing activity.

Defenders should add the IPv6 address 2a00:1450:4001:828::2001 and the fully qualified domain name to their deny lists and monitor DNS queries for similar subdomains under the blogspot.com.eg hierarchy. Because the site uses a valid TLS certificate, network‑level TLS inspection or certificate pinning can help differentiate legitimate Google services from this malicious actor. Continuous re‑evaluation of blocklist status and periodic VirusTotal rescans are recommended to track changes in vendor detection rates.