connect-uphold-com-login[.]blogspot[.]co[.]uk

The domain connect-uphold-com-login.blogspot.co.uk was identified as a credential phishing site impersonating Uphold, a digital money platform. This infrastructure was designed to harvest login credentials by presenting a fraudulent authentication interface. As of the latest assessment, the domain has been taken offline, though prior activity remains documented in security telemetry. Analysis of the domain reveals it was registered through MarkMonitor, Inc. on August 02, 2009, and resolved to the IP address 142.250.80.97, associated with AS15169 (Google LLC) in the United States. The domain was flagged by 12 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It also appeared on at least one security blocklist. The SSL certificate was issued by Google Trust Services (WE2), a common characteristic of legitimate but abused hosting environments. While the domain is currently offline, residual risk persists due to potential reuse of the infrastructure or migration of the phishing campaign to alternative domains. Organizations and users are advised to monitor for similar patterns, including subdomains mimicking financial services, and to verify SSL certificate issuers for unexpected Google Trust Services certificates on non-Google properties. Credential-based authentication to financial platforms should be augmented with multi-factor verification to mitigate exposure to such phishing attempts. Historical indicators, such as the IP and registrar, may assist in identifying related malicious activity.