en-us-uphold-login[.]blogspot[.]li

Analysis of en-us-uphold-login.blogspot.li indicates an active credential phishing operation targeting users of a financial platform. The domain, hosted on Blogger infrastructure, resolves to 142.251.140.161 (AS15169, Google LLC, US) and returns an HTTP 302 redirect, suggesting dynamic content handling or evasion tactics. The page title 'Blog not found' may reflect a placeholder or cloaking mechanism to avoid detection during initial scans. Security vendors have flagged this domain, with 11 of 95 detections on a widely used scanning platform, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services, consistent with Blogger-hosted domains, but does not mitigate the phishing risk. Technologies detected include Blogger, Java, Python, and OpenGSE, aligning with standard Blogger hosting environments, though the presence of HTTP/3 may indicate efforts to improve delivery speed or evade legacy network monitoring. The scam type is explicitly classified as credential phishing, though the exact target brand or platform is not confirmed beyond the domain naming convention. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it, particularly in environments where financial or cryptocurrency credentials are handled. Further investigation into redirect chains or associated domains may reveal additional infrastructure linked to this campaign.