login-uphold-help[.]blogspot[.]kr

This domain, login-uphold-help.blogspot.kr, is a credential phishing site designed to harvest login credentials from users attempting to access Uphold financial services. The page title, 'Uphold Login - Access Your Financial Dashboard,' closely mimics legitimate Uphold branding to deceive victims into entering sensitive account details. Analysis indicates the domain specifically targets users of cryptocurrency and digital asset platforms, exploiting trust in financial service interfaces to facilitate unauthorized account access and potential asset theft. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain is flagged by 8 out of 95 security vendors on VirusTotal, with a 'SOCIAL_ENGINEERING' classification from Google Safe Browsing. It appears on three security blocklists and is registered through Whois Corp., with a creation date of April 13, 2007, though the phishing content was recently deployed. The site resolves to the IPv6 address 2a00:1450:4001:811::2001 and employs technologies including Blogger, Java, Python, and OpenGSE, alongside HTTP/3 for data transmission. Notably, the SSL certificate is issued by Google Trust Services, which may lend false legitimacy to the site. Users who visited login-uphold-help.blogspot.kr should immediately revoke any entered credentials and enable multi-factor authentication on their Uphold accounts. Monitor financial transactions for unauthorized activity and report the incident to their platform's security team. Browser history and cache should be cleared to remove any residual session data. Organizations should update their security blocklists to include this domain and its resolving IP address to prevent further access attempts. Given the high-risk classification, affected users are advised to assume their credentials are compromised and take proactive measures to secure all linked financial accounts.