en-us-uphold-login[.]blogspot[.]co[.]nz

Analysis of the domain en-us-uphold-login.blogspot.co.nz indicates a high-risk credential phishing operation targeting users of the Uphold digital wallet platform. The domain, hosted on Blogger infrastructure, presents a page titled 'Secure Uphold Login Guide | Manage Your Digital Wallet,' which aligns with phishing tactics designed to harvest login credentials. As of July 12, 2026, the domain remains active and is flagged by 13 of 95 security vendors on VirusTotal, with one confirmed entry on a security blocklist. Infrastructure analysis reveals the domain resolves to the IPv6 address 2404:6800:4006:802::2001, associated with Google hosting services. The SSL certificate is issued by Google Trust Services, a common characteristic of both legitimate and malicious domains leveraging cloud providers. The domain was registered on September 7, 2005, under MarkMonitor, Inc., though this registration date predates the observed malicious activity and does not correlate with the phishing campaign's timeline. Technologies detected on the domain include Blogger, Java, Python, and OpenGSE, consistent with standard web hosting environments but offering no definitive attribution to a specific threat actor or phishing kit. The exact content and functionality of the page have not been analyzed, so the presence of login forms, data exfiltration methods, or additional malicious scripts remains unconfirmed. Defenders should treat this domain as actively malicious and prioritize blocking or monitoring access to it. The combination of a targeted brand name in the domain, a deceptive page title, and security vendor detections provides sufficient evidence to classify this as a credential phishing threat. Further investigation into associated IP ranges, SSL certificates, and hosting patterns may reveal additional related infrastructure.