uphold-logn-account[.]blogspot[.]sn

Analysis of the domain uphold-logn-account.blogspot.sn indicates it is an active credential phishing site targeting users of the Uphold financial platform. The domain was registered on February 21, 2026, through MarkMonitor, Inc., and currently resolves to IP address 142.250.201.65, hosted by Google LLC (AS15169) in the United States. Nameservers are set to Google’s infrastructure (ns1.google.com through ns4.google.com), and the site presents an HTTP 302 redirect status, suggesting it may be rerouting visitors to a malicious endpoint. The SSL certificate is issued by Google Trust Services, which does not inherently validate the site’s legitimacy but confirms encrypted traffic.

Security vendors have flagged this domain as malicious, with 12 out of 95 engines on VirusTotal detecting it as phishing-related. It appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The page title, 'Uphold Login Account - Your Financial Control Center,' explicitly mimics the branding of Uphold, a legitimate digital money platform, reinforcing its fraudulent intent. Gridinsoft’s trust score of 0/100 further corroborates its high-risk classification.

While the exact phishing kit or backend infrastructure remains unconfirmed, the combination of a recently registered domain, Google-hosted infrastructure, and targeted branding aligns with credential harvesting tactics. Defenders should treat this domain as hostile and prioritize blocking it at the DNS or proxy level. Users encountering this site should avoid entering credentials and report it to their security teams or the targeted brand. The domain remains active as of July 25, 2026, with no indication of takedown efforts.