uphold-logn-account[.]blogspot[.]de

This domain, uphold-logn-account.blogspot.de, is identified as a credential phishing site targeting users of financial platforms. The page mimics legitimate login portals, presenting a fraudulent interface titled 'Uphold Login Account - Your Financial Control Center' to harvest user credentials, including usernames, passwords, and potentially multi-factor authentication codes. The threat is classified as elevated due to its direct targeting of financial accounts, which could lead to unauthorized access, fund theft, or further exploitation of linked services.

Analysis indicates the domain was registered through Google LLC on February 21, 2026, and resolves to the IP address 216.58.206.65, hosted under AS15169 (Google LLC). Security vendors flagged the domain in 9 out of 95 scans on VirusTotal, with three distinct security blocklists listing it as malicious. The SSL certificate is issued by Google Trust Services (WE2), a common characteristic of phishing domains leveraging legitimate hosting infrastructure to evade initial scrutiny. The domain has since been taken offline, but residual risks remain for users who interacted with it prior to deactivation.

Users who visited uphold-logn-account.blogspot.de or entered credentials on the site should immediately revoke access to any associated accounts, reset passwords using a secure device, and enable multi-factor authentication if not already active. Monitor financial accounts for unauthorized transactions and review connected applications or services for signs of compromise. If credentials were reused across other platforms, those accounts should also be secured. Organizations should update internal blocklists to include this domain and its associated IP address to prevent future access attempts.