app-uphold-login[.]blogspot[.]co[.]uk

The domain app-uphold-login.blogspot.co.uk is presently active and classified as a high‑risk credential phishing campaign. It was registered on August 02, 2009 through MarkMonitor, Inc. and is hosted on Google’s infrastructure, resolving to IP address 172.253.63.132, which belongs to AS15169 Google LLC in the United States. The authoritative name servers are ns1.google.com through ns4.google.com, confirming reliance on Google’s DNS services.

Technical inspection shows the site is built on the Blogger platform and employs Java, Python, OpenGSE libraries, and HTTP/3 transport. An HTTP 302 response is observed, indicating a redirection mechanism. The TLS certificate is issued by Google Trust Services under the WE2 label, providing a valid HTTPS connection. Page metadata reports the title “Uphold Login | Secure Digital Access,” matching the credential‑phishing lure.

Detection metrics reveal that six out of ninety‑five VirusTotal scanners have flagged the domain, and it appears on a single external blocklist. The phishing indicator has also been incorporated into the PhishDestroy blocklist. While these signals confirm malicious activity, the limited vendor consensus suggests that some scanners may not yet recognize the payload or that the site’s content changes infrequently.

Defenders should prioritize blocking traffic to this domain at network perimeter and endpoint layers, especially for users who may interact with financial credential services. Monitoring for outbound connections to the resolved IP 172.253.63.132 and enforcing TLS inspection can reveal the 302 redirect attempts. Continuous re‑evaluation is advised, as the content behind the redirection has not been directly inspected, leaving the exact phishing page details uncertain.