uphold-login-accountt[.]blogspot[.]fr

Analysis of the domain uphold-login-accountt.blogspot.fr indicates an active credential phishing campaign targeting users of the Uphold financial platform. The domain, hosted on Blogger infrastructure, resolves to the IP address 142.250.185.161, associated with AS15169 (Google LLC) in the United States. The SSL certificate is issued by Google Trust Services, and the domain employs Google nameservers (ns1.google.com through ns4.google.com), consistent with legitimate Blogger-hosted properties. However, the page title, 'Uphold Login Account | Secure Access,' explicitly suggests an attempt to mimic the Uphold login portal, aligning with the credential phishing classification provided in the intelligence data. The domain was registered on July 2, 2007, through MarkMonitor, Inc., though this registration date predates the observed malicious activity and likely reflects the creation of the underlying Blogspot subdomain infrastructure rather than the phishing content itself. As of July 12, 2026, the domain remains active, returning an HTTP 302 status code, which may indicate a redirect to a secondary phishing endpoint or a mechanism to evade detection. Technologies detected on the domain include Blogger, Java, Python, and OpenGSE, further confirming its hosting on Google's platform. Defenders should note that this domain has been flagged by 10 of 95 security vendors in VirusTotal and appears on at least one security blocklist. The use of a well-established hosting provider complicates mitigation, as takedown requests may require direct engagement with Google's abuse teams. Organizations are advised to block the domain at the network level and monitor for related subdomains or redirect chains that may emerge as part of this campaign. The exact content of the phishing page has not been analyzed, but the combination of the page title, phishing classification, and hosting context strongly suggests an attempt to harvest Uphold user credentials.