up-holdlogi[.]blogspot[.]be

The domain up-holdlogi.blogspot.be is identified as a credential theft site specifically targeting users of the Uphold digital asset platform. Analysis confirms the domain was designed to harvest login credentials under the guise of a legitimate Uphold sign-in portal. As of the latest scan, the domain has been taken offline, though prior activity indicates a focused campaign against cryptocurrency account holders. Infrastructure analysis reveals the domain resolved to IP address 172.217.18.1, hosted under AS15169 (Google LLC) in the United States. The SSL certificate was issued by Google Trust Services (WE2), a common pattern for abused blogging platforms. The domain was registered through MarkMonitor, Inc. on February 1, 2003, though the subdomain itself appears to be a recent creation. Security vendors flagged this domain on 3 distinct blocklists, with 9 of 95 VirusTotal engines detecting malicious activity. The page title, 'Uphold Login – Secure Sign-In Guide,' further confirms the intent to deceive users into submitting sensitive account details. Current status indicates the domain is offline, reducing immediate risk to end users. However, the infrastructure remains potentially exploitable for future campaigns. Organizations and individuals are advised to block the domain at the network level and monitor for similar patterns, such as subdomains under blogspot.be or other free hosting services impersonating financial platforms. Users who may have interacted with this domain should immediately rotate credentials for Uphold and any other accounts where passwords were reused. Security teams should review logs for connections to 172.217.18.1 or related indicators to identify potential compromise.