en-us-uphold-login[.]blogspot[.]my

Analysis indicates that en-us-uphold-login.blogspot.my is an active credential-phishing domain targeting users of the Uphold digital wallet platform. The domain, hosted on Blogger infrastructure, presents itself with the page title 'Secure Uphold Login Guide | Manage Your Digital Wallet,' which aligns with known phishing tactics designed to deceive users into entering login credentials. Infrastructure analysis reveals the domain resolves to IP address 142.251.167.132, registered under Google LLC (AS15169) in the United States, with nameservers ns1.google.com through ns4.google.com. The domain was originally created on January 28, 2015, and is registered through MarkMonitor, Inc., though its current malicious use appears to be a repurposing of existing infrastructure rather than a newly registered entity.

The domain is currently flagged by 11 of 95 security vendors on VirusTotal as malicious, with PhishDestroy listing it on its blocklist. The site returns an HTTP 302 redirect status, which is commonly used in phishing campaigns to obscure the final malicious destination. The SSL certificate is issued by Google Trust Services (WE2), a legitimate provider, which does not mitigate the domain's malicious intent. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, consistent with a Blogger-hosted phishing page.

Defenders should note that this domain is classified as a crypto scam, specifically targeting Uphold users. While the exact content of the phishing page has not been analyzed, the combination of the page title, scam classification, and detection by security vendors confirms its malicious purpose. Organizations are advised to block this domain at the DNS or proxy level and monitor for related infrastructure, particularly any subdomains or redirect chains leading to this endpoint. Given its active status and high-risk classification, user education regarding credential phishing targeting digital wallets is recommended.