en-us-uphold-login[.]blogspot[.]pe

Analysis indicates that the domain en-us-uphold-login.blogspot.pe is flagged as an active credential phishing resource tied to cryptocurrency operations with high risk confirmed on July 12 2026. It resolves to IP 142.250.80.65 under AS15169 Google LLC in the United States and uses nameservers ns1.google.com ns2.google.com ns3.google.com ns4.google.com. Technologies detected on the infrastructure include Blogger Java Python OpenGSE and HTTP/3 while the SSL certificate originates from Google Trust Services under the WE2 root. The domain returns HTTP status 302 and registers on exactly one security blocklist with explicit blocking noted by PhishDestroy. Registration occurred through MarkMonitor Inc.

VirusTotal reports detections from 7 out of 95 vendors and the listed page title reads Secure Uphold Login Guide | Manage Your Digital Wallet which matches the cryptocurrency scam classification. Infrastructure analysis reveals the domain operates on shared Google-hosted resources which can extend dwell time before remediation. The combination of a 302 redirect and Google nameservers indicates possible redirection chains that defenders must account for during incident scoping.

Details that remain uncertain include the full duration of activity prior to July 12 2026 and any additional redirection targets beyond the recorded 302 response. Defenders should block the domain en-us-uphold-login.blogspot.pe and IP 142.250.80.65 at network perimeters email filters and endpoint controls without delay. Continuous monitoring of blogspot.pe subdomains for matching page titles is advised and alerts should be generated on any references to the exact title text in web proxy or DNS logs. Cross-checking against the single known blocklist and PhishDestroy indicators will support ongoing validation of protective measures.