en-uphold-login-app[.]blogspot[.]co[.]za

This domain, en-uphold-login-app.blogspot.co.za, is identified as a credential phishing site specifically targeting users of the Uphold digital asset platform. The site impersonates the legitimate Uphold login interface to harvest credentials associated with cryptocurrency and digital asset accounts. As of the latest assessment, the domain has been taken offline, though prior activity indicates a high-risk classification due to its direct targeting of financial authentication data. Analysis indicates the domain was flagged by 12 of 95 security vendors on VirusTotal, reflecting moderate detection coverage. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. The domain resolves to the IPv6 address 2404:6800:4004:807::2001, hosted under autonomous system AS15169 (Google LLC) in Australia. Despite its creation date of February 24, 2005, the subdomain structure and content suggest recent malicious repurposing. The domain appears on three security blocklists and is explicitly flagged for phishing by Google Safe Browsing. The SSL certificate, issued by Google Trust Services (WE2), does not mitigate the inherent risk posed by the fraudulent content. The current status of the domain is offline, reducing immediate exposure to end users. However, the infrastructure remains potentially reusable for future campaigns. Organizations and individuals are advised to implement blocklist updates to prevent access if the domain resurfaces. End users should verify the authenticity of login portals by cross-referencing official domain names and enabling multi-factor authentication on financial accounts. Security teams are recommended to monitor for similar subdomain patterns under reputable hosting providers, as these are frequently exploited for short-lived phishing operations.