uphold-loginaccount[.]blogspot[.]sg

Analysis of the domain uphold-loginaccount.blogspot.sg confirms its classification as an active credential phishing site targeting Uphold users. The domain, hosted on Blogger infrastructure, resolves to 74.125.200.132 within AS15169 (Google LLC) and is geolocated in Singapore. Nameservers are ns1.google.com through ns4.google.com, and the SSL certificate is issued by Google Trust Services (WE2), consistent with legitimate Blogger-hosted properties but repurposed for malicious activity. The page title, 'How Can You Securely Access Your Uphold Login Account?', explicitly references Uphold, indicating an intent to deceive users into submitting credentials. The domain was registered on September 15, 2010, and remains active as of July 12, 2026, returning an HTTP 302 redirect, which may be used to obscure the final phishing endpoint. Technologies detected include Blogger, Java, Python, OpenGSE, and HTTP/3, aligning with standard Blogger hosting but providing no definitive evidence of custom phishing kits. Security vendors have flagged this domain, with 12 of 95 engines on VirusTotal identifying it as malicious. It appears on one security blocklist and is currently blocked by at least one anti-phishing service. While the domain's age and hosting on a reputable platform may reduce initial suspicion, the combination of a targeted Uphold-themed page title, HTTP redirect behavior, and detection by multiple security vendors confirms its malicious intent. Defenders should treat this domain as a high-risk credential phishing threat. Blocking at the network level is recommended, particularly for organizations with Uphold-related user activity. Further investigation into the redirect chain and final landing page is advised to identify additional infrastructure or payloads. The domain's use of Blogger hosting suggests it may evade some traditional detection methods, warranting heightened monitoring for similar subdomain-based phishing campaigns.