uphold-logn-account[.]blogspot[.]in

This domain was identified as a credential harvesting phishing site designed to mimic a legitimate financial services login portal. Visitors were presented with a fraudulent interface titled 'Uphold Login Account - Your Financial Control Center,' intended to deceive users into submitting sensitive account credentials, including usernames, passwords, and potentially multi-factor authentication codes. The site specifically targeted users of a well-known digital asset platform, exploiting trust in its branding to facilitate unauthorized access to financial accounts. Analysis indicates the domain was registered on February 21, 2026, through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. The site resolved to IP address 142.251.208.1, hosted under Google LLC (AS15169), which is consistent with the use of a free blogging platform to evade initial detection. Security vendor assessments on VirusTotal revealed that 10 out of 95 engines flagged the domain as malicious. Additionally, the domain appeared on three independent security blocklists, and its SSL certificate, issued by Google Trust Services, provided a superficial layer of legitimacy while failing to prevent classification as high-risk. Individuals who accessed this domain or entered credentials on the site should assume their login details have been compromised. Immediate steps include changing passwords for the targeted financial service and any other accounts where the same credentials may have been reused. Enabling multi-factor authentication, where available, is strongly recommended. Users should also monitor their financial accounts for unauthorized transactions and report any suspicious activity to the legitimate service provider. Organizations are advised to block the domain and associated IP at the network level to prevent further exposure.