connect-uphold-login[.]blogspot[.]dk

Analysis indicates that the domain connect-uphold-login.blogspot.dk is actively involved in a credential phishing campaign, posing as a legitimate Uphold login page. The domain was created on May 23, 2011, and is currently registered through MarkMonitor, Inc. Despite the domain's age, it has been flagged by 10 out of 95 security vendors on VirusTotal, suggesting a significant level of malicious activity. The domain has also appeared on one security blocklist, further corroborating its suspicious nature. The SSL certificate for this domain is issued by Google Trust Services, which may be leveraged to bypass some security checks and gain user trust. The IP address to which the domain resolves is 2a00:1450:4001:80b::2001, indicating the use of a well-known hosting infrastructure. The technologies detected on the site include Blogger, Java, Python, and OpenGSE, with the site supporting HTTP/3. The page title, 'How Can You Easily Access Uphold Login Safely?', suggests that the domain is designed to trick users into believing they are visiting a secure and legitimate login page for Uphold. While the exact content of the page has not yet been fully analyzed, the combination of the page title, domain name, and security vendor flags strongly indicates a phishing attempt aimed at stealing user credentials. Defenders are advised to monitor and block this domain, educate users about the risks of credential phishing, and implement additional verification steps for Uphold logins to prevent unauthorized access.