upholddlogin[.]blogspot[.]com[.]ar

The domain upholddlogin.blogspot.com.ar was created on February 21, 2026 and is currently active. VirusTotal records show that 12 of 93 security vendors have flagged the domain, indicating a measurable level of malicious detection across multiple scanners. Gridinsoft assigns it a trust score of 0 out of 100, reinforcing the assessment of high risk. The site presents the page title "Uphold | Login," matching the declared scam type of credential phishing, though the actual page content has not been inspected. Google Safe Browsing lists the domain under social engineering, and three external blocklists—including PhishDestroy, MetaMask, and SEAL—have already added it to their deny lists.

The domain resolves to IP address 142.251.141.129, which belongs to AS15169 Google LLC and is hosted in the United States. SSL is provided by Google Trust Services under the WE2 certificate, which does not mitigate the phishing risk because the certificate merely validates the hosting provider, not the legitimacy of the hosted content. Technical fingerprints reveal the use of Blogger as the underlying CMS together with Java, Python, OpenGSE, Clipboard.js, and HTTP/3, all of which are common in legitimate sites but can also be leveraged to deliver malicious scripts. The registrar listed as "nicar" and the Google nameservers (ns1‑ns4.google.com) are consistent with a legitimate Google‑hosted blog, a factor that may aid evasion of simple domain‑based filters.

HTTP responses return a 302 redirect, a pattern frequently employed by phishing actors to forward victims to credential‑harvesting pages after initial loading. Defenders should therefore treat the domain as high‑risk: block resolution of upholddlogin.blogspot.com.ar at the DNS level, add the IP 142.251.141.129 to outbound traffic denial lists when associated with suspicious redirect patterns, and incorporate the domain into existing URL filtering rules.