uphold-logiiin[.]blogspot[.]ro

Analysis indicates that the domain uphold-logiiin.blogspot.ro is actively engaged in credential phishing targeting users of the Uphold financial platform. The domain, hosted on Blogger infrastructure, resolves to IP address 142.251.111.132, which belongs to AS15169 (Google LLC) in the United States. The page title, 'Uphold Login | Secure Access to Your Uphold Account,' explicitly suggests an attempt to mimic the legitimate Uphold login interface, though the exact content and functionality of the site remain unconfirmed. Infrastructure analysis reveals that the domain is registered under MarkMonitor, Inc., and was created on May 14, 2006, though the subdomain in question appears to be a more recent addition. The domain employs Google’s nameservers (ns1.google.com through ns4.google.com) and an SSL certificate issued by Google Trust Services (WE2). Detection data from security vendors shows that 12 of 95 engines on VirusTotal have flagged the domain as malicious, and it is currently listed on one security blocklist. The HTTP status code 302 suggests the site may be redirecting visitors, though the final destination remains undetermined. Defenders are advised to treat this domain as high-risk. Given its association with a known financial service and the presence of active phishing indicators, network-level blocking is recommended. Further investigation into the redirection chain and any associated payloads is warranted to determine the full scope of the campaign. No evidence currently links this domain to broader malware distribution or additional threat vectors beyond credential harvesting.