connect-uphold-login[.]blogspot[.]com[.]br

The domain connect-uphold-login.blogspot.com.br is currently active and has been identified as a credential phishing site. It surfaced in threat feeds with a high risk rating and is listed as blocked by PhishDestroy. The page title observed is “How Can You Easily Access Uphold Login Safely?”, indicating an attempt to lure users seeking Uphold account access. Infrastructure analysis shows the domain resolves to the IP address 142.250.186.129, which belongs to the AS15169 block owned by Google LLC, confirming hosting on a major cloud provider. The site serves over HTTP/3 and returns an HTTP 302 redirect, suggesting the use of redirection chains. Detected technologies include Blogger, Java, Python, and OpenGSE, and the TLS certificate is issued by Google Trust Services under the WE2 profile, providing a valid HTTPS connection. VirusTotal has recorded 12 out of 95 security vendors flagging the domain, reinforcing the malicious classification. It appears on one additional security blocklist, and the combination of the observed page title, the credential phishing tag, and the redirection behavior aligns with typical credential harvesting campaigns. No direct content analysis is available, so the exact phishing page layout and data collection mechanisms remain unverified. Defenders should immediately block the domain at network perimeters and add the associated IP address to deny lists. Monitoring for DNS queries to this hostname can help detect compromised hosts attempting to reach the site. Given the legitimate hosting provider, any false‑positive mitigation should be validated against the observed redirection and page title indicators before allowing exceptions.