uphold-logiiin[.]blogspot[.]com[.]by

The domain uphold-logiiin.blogspot.com.by has been identified as a credential theft operation specifically targeting users of the Uphold financial platform. Analysis confirms the domain impersonates the legitimate Uphold login portal, presenting a fraudulent page titled 'Uphold Login | Secure Access to Your Uphold Account.' As of the latest assessment, the domain has been taken offline, though prior activity indicates a deliberate attempt to harvest user credentials for unauthorized account access. Infrastructure analysis reveals the domain was registered through Reliable Software, Ltd, with a creation date of October 22, 2014, though recent malicious activity suggests compromise or repurposing. The domain resolves to the IP address 142.250.185.225, hosted under AS15169 (Google LLC) in the United States. Security vendors have flagged the domain, with 11 of 95 VirusTotal engines detecting malicious behavior. The domain appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE2), which, while legitimate, does not mitigate the fraudulent nature of the content served. Current status indicates the domain is offline, reducing immediate risk to users. However, the infrastructure remains a potential vector for future malicious activity. Organizations and users are advised to monitor for similar impersonation attempts, particularly those leveraging subdomains of legitimate platforms. Network defenders should update blocklists to include this domain and its associated IP address. Users who may have interacted with the domain should immediately reset credentials for Uphold and any other accounts where identical login details were reused. Enhanced scrutiny of SSL certificates and registrar details is recommended for domains mimicking financial services.