app-uphold-login[.]blogspot[.]hr

This domain is flagged for hosting a credential theft operation targeting users of the Uphold digital asset platform. Analysis indicates the site impersonates the legitimate Uphold login interface under the title 'Uphold Login | Secure Digital Access,' a tactic designed to deceive users into submitting their authentication credentials. The threat level is classified as elevated due to the domain's active deployment in a targeted phishing campaign and its detection by multiple security mechanisms. Infrastructure analysis reveals the domain resolves to the IP address 142.250.185.193, which is registered under AS15169 (Google LLC) and located in the United States. The SSL certificate is issued by Google Trust Services (WE2), a common characteristic of attacker-abused free hosting platforms. Detection metrics from VirusTotal show that 11 out of 95 security vendors have flagged the domain as malicious, while it appears on at least one security blocklist. The domain is currently offline, though its prior operational status and detection history warrant continued scrutiny. To mitigate risks associated with credential theft, affected users should immediately revoke any sessions linked to the fraudulent domain and enable multi-factor authentication on their legitimate accounts. Organizations should update endpoint protection rules to block the domain and its associated IP address (142.250.185.193) at the network perimeter. Security teams are advised to monitor for unauthorized access attempts originating from credentials potentially compromised through this campaign, particularly those tied to financial or cryptocurrency platforms. Users who interacted with the domain should assume their credentials were exposed and take proactive steps to secure their accounts.