uphold-logn-account[.]blogspot[.]sg

Uphold-logn-account.blogspot.sg was a credential phishing site designed to mimic the login page of Uphold, a digital wallet service. The domain was hosted on an IP address associated with Google LLC, specifically under ASN AS15169, and utilized an SSL certificate issued by Google Trust Services. Despite its legitimate appearance, the site was flagged by 11 out of 93 vendors on VirusTotal as malicious, highlighting its threat potential before being taken down.

This phishing operation aimed to harvest user credentials by tricking victims into entering their login details on a fake Uphold login page. PhishDestroy identified this threat on February 18, 2026, three days before its official domain creation date, indicating early detection capabilities. The domain was also listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, which contributed to its swift takedown.

The use of a reputable registrar like MarkMonitor, Inc. and hosting on Google's infrastructure may have lent an air of legitimacy to the domain, potentially deceiving users into believing it was a genuine site. However, the rapid identification and flagging by multiple security vendors and blocklists underscore the effectiveness of collaborative threat intelligence in mitigating phishing risks. The domain's offline status now prevents further exploitation attempts, but it serves as a reminder of the persistent threat posed by credential phishing campaigns.