uphold-login-accountt[.]blogspot[.]hk

This domain is flagged as an active credential phishing threat targeting users of the Uphold financial platform. The domain name, uphold-login-accountt.blogspot.hk, employs a typosquatting technique by adding an extra 't' to 'account' and using a subdomain structure that mimics official Uphold login pages. The page title confirms the intent: 'Uphold Login Account | Secure Access'. The domain was created on November 27, 2010, and is hosted on Google's infrastructure (AS15169, IP 172.217.18.1) using Blogger, Java, Python, OpenGSE, and HTTP/3 technologies. The SSL certificate is issued by Google Trust Services, and the domain returns an HTTP 302 redirect, suggesting visitors are likely forwarded to a credential harvesting page. VirusTotal data shows 9 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist (PhishDestroy). The domain is registered through MarkMonitor, Inc. and uses Google nameservers. The exact content of the landing page has not been analysed, so the specific phishing form design or redirect chain is not confirmed. The domain remains active as of the report date, July 12, 2026. Defenders should immediately block this domain at the network level and add it to email security filters to prevent users from clicking links in phishing messages. Organizations using Uphold should notify their users about this specific domain and reinforce general credential phishing awareness. Monitoring for related subdomains or variations on blogspot.com is recommended, as threat actors often create multiple similar pages. If any user credentials have been submitted to this domain, forced password resets and session invalidation should be performed. The domain's age and use of legitimate Google services make it harder to filter based on reputation alone, so URL pattern detection and user reporting remain critical.