docs-uphold-wallet[.]blogspot[.]com[.]uy

On July 24 2026 the domain docs-uphold-wallet.blogspot.com.uy was observed delivering a high‑risk crypto‑drainer operation. The site presents the HTTP title “Blog not found” and immediately issues a 302 redirect, indicating that the underlying content is likely hidden or dynamically generated. The domain was registered on 21 February 2026 and resolves to IP 142.251.141.65, an address owned by Google LLC (AS15169) located in the United States. TLS is provided by Google Trust Services under the WE2 certificate, confirming that the connection uses a legitimate Google‑issued certificate. Service fingerprinting identified Blogger as the hosting platform together with runtime components for Java, Python and the OpenGSE library, and the server negotiates HTTP/3, suggesting a modern Google front‑end.

VirusTotal has recorded 13 positive detections out of 93 scanned scanners, and three independent blocklists have already listed the domain. It is additionally blocked by the PhishDestroy, MetaMask, and SEAL protection services, reinforcing the assessment that the domain is actively used for malicious cryptocurrency extraction. The “Crypto Scam” label in the intelligence matches the observed behavior of a drainer that typically attempts to lure victims into authorizing token transfers. Current uncertainties include the exact payload delivered after the redirect and whether the site hosts additional phishing pages targeting other brands.

No public content has been captured beyond the title, and no sandbox analysis is available. Defenders should block the domain at the network perimeter, enforce DNS sink‑hole rules, and add the associated IP address to endpoint deny lists. Continuous monitoring of the certificate fingerprint and any changes in the redirect chain is advised, as well as periodic re‑scans on VirusTotal to capture new detections.