upholddlogin[.]blogspot[.]ie

The domain upholddlogin.blogspot.ie has been identified as a credential theft operation impersonating Uphold, a cryptocurrency platform. Analysis confirms the domain was designed to harvest login credentials from unsuspecting users by replicating the legitimate Uphold login interface. The domain is currently offline, but prior activity and infrastructure details indicate a deliberate attempt to deceive users into disclosing sensitive account information. Infrastructure analysis reveals the domain was flagged by 11 of 95 security vendors on VirusTotal, indicating a high likelihood of malicious intent. Registered through MarkMonitor, Inc., the domain resolves to the IP address 142.251.208.161, hosted on Google LLC's infrastructure (AS15169). The domain creation date is listed as February 21, 2026, suggesting an attempt to exploit future-dated records for evasion. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged as phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WE2), which, while legitimate, does not mitigate the domain's fraudulent purpose. Given the domain's current offline status, immediate threat exposure is reduced. However, users who may have interacted with the domain should take proactive measures, including resetting passwords for any accounts accessed during the exposure window and enabling multi-factor authentication. Organizations are advised to monitor for indicators of compromise, such as the domain name, associated IP address, and SSL certificate details, within their network logs. Blocking the domain and its resolving IP at the perimeter level is recommended to prevent potential re-emergence or similar threats from the same infrastructure.