uphold-wallet-io[.]blogspot[.]lt

Analysis indicates that the domain uphold-wallet-io.blogspot.lt is actively being used as a crypto‑drainer. The site returns an HTTP 302 redirect and the page title returned is "Blog not found", which is typical of a placeholder blog hosted on Blogger. The domain was registered on 21 February 2026 through MarkMonitor, Inc., and its DNS resolves to 172.217.18.1, an address owned by Google (AS15169, United States). The SSL certificate is issued by Google Trust Services under the WE2 intermediate, confirming that TLS termination is performed by Google’s infrastructure. Technology fingerprints collected by passive scanners list Blogger, Java, Python, OpenGSE and HTTP/3, confirming the use of Google’s blogging platform and modern transport protocols.

VirusTotal has flagged the domain in 12 of 93 scanners, and the domain appears on three external blocklists. It is also listed as blocked by PhishDestroy, MetaMask, and SEAL, indicating that both generic phishing and wallet‑specific defenses have identified it. The combination of a recent registration date, Google‑hosted infrastructure, and the "crypto drainer" classification suggests that the operator is leveraging a legitimate hosting provider to hide malicious activity and to evade reputation‑based filters. Uncertainty remains around the exact payload delivered to victims; no sample URLs or malicious scripts have been publicly disclosed, and the content of the redirected page has not been captured. Consequently, the full kill chain – whether the site harvests private keys, redirects to a malicious wallet, or injects malicious code – cannot be confirmed at this time.

Defenders should add uphold-wallet-io.blogspot.lt to deny‑list rules at the DNS and proxy layers, monitor for outbound connections to the IP 172.217.18.1 that originate from wallet‑related processes, and enforce strict URL filtering for any HTTP 302 responses that resolve to Google‑hosted blogs.