uphold-login-accountt[.]blogspot[.]tw

This domain, uphold-login-accountt.blogspot.tw, is identified as a credential phishing site targeting users of the Uphold financial platform. Analysis indicates the site impersonates the legitimate Uphold login interface, presenting a page titled 'Uphold Login Account | Secure Access' to deceive victims into submitting account credentials. The infrastructure leverages a blogspot subdomain, a common tactic to exploit trusted hosting providers and evade initial scrutiny. No specific drainer kit signatures were detected in preliminary scans, though the page structure aligns with known phishing templates designed for credential harvesting. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain resolves to IP address 142.250.77.161, hosted under AS15169 (Google LLC) in the United States, a pattern observed in abuse of free hosting services. The domain was originally registered on February 9, 2011, though the subdomain appears to have been recently repurposed for malicious activity. VirusTotal reports 11 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist (PhishDestroy). The SSL certificate is issued by Google Trust Services (WE2), providing a false sense of security to potential victims. The domain is currently offline, reducing immediate risk to end users. However, residual threats persist, including potential reuse of harvested credentials or redeployment of the phishing infrastructure under a new subdomain. Response actions should include monitoring for credential abuse patterns, particularly targeting Uphold account holders, and tracking related subdomains under the blogspot.tw namespace. Users are advised to verify domain authenticity before entering credentials and to enable multi-factor authentication on financial accounts to mitigate phishing risks.