uphold-logins[.]blogspot[.]fi

The domain uphold-logins.blogspot.fi is a credential-phishing site designed to steal login credentials from victims. It does not impersonate a specific brand but uses the name 'uphold' to deceive users into entering sensitive information. As of the latest verification, the site has been taken offline, but it previously posed a high risk of credential theft through a fraudulent login page titled 'uphold login'.

Technical analysis shows that uphold-logins.blogspot.fi was flagged by 15 of 95 VirusTotal security vendors, including ADMINUSLabs, alphaMountain.ai, and BitDefender. Google Safe Browsing classified it as 'SOCIAL_ENGINEERING' under phishing threats. The domain appears on three security blocklists: PhishDestroy, MetaMask, and SEAL. It was registered through MarkMonitor, Inc. on March 06, 2011, and resolved to the IP address 142.251.111.132, hosted by Google LLC in the US. The SSL certificate was issued by Google Trust Services / WE2. Technologies detected on the site included Blogger, Java, Python, OpenGSE, Clipboard.js, and HTTP/3. The domain currently returns an HTTP 404 status, confirming its offline status.

Victims of uphold-logins.blogspot.fi should immediately change passwords for any accounts accessed through the site, particularly if credentials were reused. Enabling two-factor authentication (2FA) on all sensitive accounts is strongly recommended to prevent unauthorized access. Monitor financial and personal accounts for signs of fraud or unauthorized activity. Report the phishing domain to Google Safe Browsing, the registrar (MarkMonitor), and local cybersecurity authorities to aid in takedown efforts and prevent further abuse.