en-uphold-login-app[.]blogspot[.]ca

This domain poses a high-risk credential phishing threat targeting users of a cryptocurrency platform. The site mimics the legitimate login interface of a well-known digital asset service, presenting a page titled 'Uphold Login | Secure Access to Your Crypto & Digital Assets.' Visitors are prompted to enter sensitive credentials, which are then harvested by threat actors for unauthorized account access, financial theft, or further exploitation. The fraudulent nature of the page is designed to exploit trust in the brand, leveraging familiar branding elements to deceive users into disclosing login details. Analysis indicates the domain is part of a subdomain structure hosted on a widely used blogging platform, registered through MarkMonitor, Inc., with a creation date of October 18, 2006. While the parent domain has a long-standing registration, the subdomain in question is flagged by 10 out of 95 security vendors on VirusTotal, including detection by PhishDestroy, MetaMask, and SEAL. The domain resolves to the IP address 142.250.81.225, associated with AS15169 (Google LLC), and appears on three security blocklists. The SSL certificate, issued by Google Trust Services, does not mitigate the phishing risk, as encryption is commonly exploited to lend false legitimacy to malicious sites. Users who visited en-uphold-login-app.blogspot.ca and entered credentials should immediately revoke access to any linked accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Passwords for the compromised account and any reused credentials should be changed across all platforms. Network-level protections, such as DNS filtering or endpoint detection, can block future access to known phishing infrastructure. If financial data or recovery codes were submitted, affected parties should contact their financial institution and the legitimate service provider to report the incident and request account lockdown procedures.