login-uphold-help[.]blogspot[.]com[.]ar

This domain, login-uphold-help.blogspot.com.ar, is actively flagged as a credential phishing threat targeting users of a cryptocurrency platform. Analysis indicates the domain was registered on February 21, 2026, and remains operational as of July 12, 2026. The page currently returns an HTTP 302 redirect status, suggesting it may be part of a larger redirection chain designed to obscure the final phishing destination. The title 'Blog introuvable' (Blog not found) is inconsistent with the domain's naming convention, which mimics a legitimate service, further supporting the phishing classification. Infrastructure analysis reveals the domain resolves to 216.58.206.65, an IP address associated with Google LLC (AS15169) in Germany. The use of Blogger as the hosting platform aligns with common phishing tactics leveraging free or low-cost services to evade detection. The domain's nameservers are managed by LACNIC and NIC Argentina, a typical configuration for domains under the .com.ar TLD. While the SSL certificate is issued by Google Trust Services, this does not mitigate the phishing risk, as certificates are routinely issued for malicious domains. Security vendors have flagged this domain, with 9 out of 95 engines on VirusTotal detecting it as malicious. Google Safe Browsing has specifically classified it under 'SOCIAL_ENGINEERING,' confirming its use in phishing campaigns. The domain appears on at least one security blocklist, indicating prior identification and mitigation efforts. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it. Network-level protections, such as DNS filtering or IP-based restrictions, are recommended to prevent user exposure. Given the domain's active status, ongoing monitoring for changes in behavior or infrastructure is advised.