uphold-wallet-io[.]blogspot[.]si

Analysis of uphold-wallet-io.blogspot.si as of 24 July 2026 shows that the domain is actively used in a crypto‑drainer campaign. The domain was registered on 21 February 2026 through MarkMonitor, Inc. and is hosted on Google’s infrastructure (ASN 15169, United States). DNS resolution points to IP address 142.251.141.65, which belongs to Google LLC and serves content over HTTP/3. The TLS certificate presented is issued by Google Trust Services under the WE2 designation, indicating a legitimate‑looking HTTPS endpoint.

An HTTP 302 redirect is observed, and the only visible page title returned is “Blog not found”, suggesting the site may be cloaking or redirecting victims to a malicious payload that has not been captured in this report. Technical fingerprints include the presence of Blogger platform components together with Java, Python, and OpenGSE libraries, which are commonly leveraged in automated phishing and crypto‑draining toolkits. VirusTotal scans have flagged the domain in 13 of 93 security vendors, reinforcing the suspicion of malicious activity. The domain currently appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat‑intelligence feeds consider it hostile.

While the infrastructure and detection metadata are clear, the exact malicious payload, transaction addresses, or victim interaction flow remain unknown because the site content was not retrieved beyond the generic title. Consequently, defenders should treat the domain as high‑risk. Recommended actions include adding the domain to network‑level deny lists, updating endpoint protection signatures, monitoring for outbound connections to the associated IP, and enforcing strict URL filtering for any URLs containing the “uphold‑wallet‑io.blogspot.si” suffix. Continuous re‑scanning is advised to detect any changes in hosting or content that could alter the threat profile.