app-uphold-login[.]blogspot[.]bg

This domain, app-uphold-login.blogspot.bg, is currently flagged as an active credential phishing site targeting users of the Uphold digital asset platform. Analysis indicates the page title explicitly references 'Uphold Login | Secure Digital Access,' suggesting an attempt to impersonate the legitimate Uphold authentication portal. The domain is hosted on Blogger infrastructure, resolving to the IP address 142.250.186.97, which is associated with Google's network. While the SSL certificate is issued by Google Trust Services, providing an appearance of legitimacy, this alone does not mitigate the phishing risk, as certificates are routinely issued to malicious actors leveraging free hosting services. Infrastructure analysis reveals the use of Blogger as the hosting platform, alongside detected technologies including Java, Python, and OpenGSE. The domain is flagged by 12 out of 95 security vendors on VirusTotal, indicating moderate detection coverage but not universal blocking. Additionally, the domain appears on at least one security blocklist, further corroborating its malicious classification. The registrar details remain undisclosed, but the use of a Blogger subdomain aligns with common phishing tactics to evade domain reputation systems. The exact content and functionality of the phishing page have not yet been fully analyzed, though the page title suggests it is designed to harvest login credentials. Defenders are advised to treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Monitoring for connections to 142.250.186.97 or subdomains of blogspot.bg may aid in detecting related phishing activity. Given the domain's persistence as of July 12, 2026, organizations should prioritize user awareness regarding credential phishing risks, particularly those targeting financial or cryptocurrency platforms.