docs-uphold-wallet[.]blogspot[.]co[.]il

Analysis as of July 24 2026 confirms that docs-uphold-wallet.blogspot.co.il is being used in a high‑risk crypto drainer campaign. The domain was registered on 21 February 2026 through Domain The Net Technologies Ltd and is hosted on Google’s infrastructure (AS15169, United States). DNS resolution points to 172.217.20.129, a Google‑owned address that presents a valid Google Trust Services / WE2 SSL certificate. The site returns an HTTP 302 response and reports the page title “Blog not found”, indicating that the underlying Blogger instance is either empty or deliberately cloaked. Automated scanners have identified the presence of Blogger, Java, Python, OpenGSE and HTTP/3 on the host.

Ten of ninety‑three VirusTotal scanners flag the domain as malicious, and the URL is listed on three independent security blocklists. It is also blocked by PhishDestroy, MetaMask and SEAL, reinforcing the assessment that the site is attempting to lure cryptocurrency users. The specific “crypto drainer” tactic is corroborated by the intelligence tag “Crypto Scam”. No additional content has been captured, so the exact luring mechanism (e.g., phishing pages, malicious smart‑contract calls) remains unverified.

Defenders should treat any traffic to this domain as hostile. Recommendations include adding the domain to local deny lists, enforcing network‑level blocks, monitoring for requests to the resolved IP, and alerting users of potential wallet compromise attempts. Continued observation of the domain’s DNS and HTTP behavior is advised, as further payloads may be delivered via the Blogger platform or through redirects hidden behind the 302 response. The infrastructure—Google‑provided nameservers ns1‑ns4.google.com—makes takedown difficult, so containment at the client and perimeter layers is the most effective mitigation.