uphold-login-accountt[.]blogspot[.]ru

Uphold‑login‑accountt.blogspot.ru is flagged as a credential‑phishing site targeting users of the Uphold service. The site presents a page titled “Uphold Login Account | Secure Access”, indicating an attempt to harvest login credentials. Technical analysis shows the domain is hosted on Blogger infrastructure, as reflected by the presence of Google nameservers (ns1‑ns4.google.com) and an SSL certificate issued by Google Trust Services (WE2). The domain resolves to the IPv6 address 2a00:1450:4001:82a::2001, which belongs to the Google LLC network (AS15169) and is geolocated in Germany. HTTP requests receive a 302 redirect, a common technique for forwarding victims to a credential‑collection endpoint. The domain was created on 29 August 2005 and is registered through RU‑CENTER‑RU, suggesting an older registration that may be repurposed for malicious use.

VirusTotal scans have flagged the domain in 15 of 95 security engines, indicating a moderate consensus of malicious activity. The domain appears on at least one public blocklist and has been actively blocked by PhishDestroy, yet it remains reachable, confirming its active status. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, consistent with a modern web stack that can support dynamic content and rapid content delivery. No further payload or script analysis is available, so the exact credential‑capture mechanism remains unknown.

Defenders should add the IPv6 address and the fully qualified domain name to web‑filtering and DNS‑sinkhole rules to prevent user access. Email gateways should inspect inbound messages for URLs pointing to the blogspot.ru domain and apply URL reputation checks. Because the site uses a legitimate Google‑issued TLS certificate, standard TLS inspection may be required to uncover malicious payloads. Continuous monitoring of the domain’s DNS records and blocklist status is advised, as the infrastructure can be altered without notice.