login-uphold-help[.]blogspot[.]mk

This domain, login-uphold-help.blogspot.mk, is actively impersonating Uphold, a financial services platform, as indicated by the page title 'Uphold Login - Access Your Financial Dashboard' and the scam type classified as credential phishing. Infrastructure analysis reveals the domain is hosted on Google LLC (AS15169) with an IP resolution of 142.251.208.1, utilizing Google's nameservers (ns1-4.google.com) and SSL certificate issued by Google Trust Services. The domain was registered on September 23, 2011, through UNET-REG, though the age does not preclude malicious use, as threat actors frequently abuse legitimate platforms like Blogger for phishing campaigns. A 302 HTTP status suggests potential redirection to another malicious endpoint, though the exact destination remains unconfirmed. Seven security vendors on VirusTotal have flagged this domain, and it appears on one security blocklist, indicating moderate detection coverage. Defenders should prioritize blocking this domain at the DNS or proxy level, particularly for financial services environments. The use of Blogger infrastructure complicates takedown efforts, as the platform may require additional abuse reporting. No specific phishing kit or obfuscation techniques are confirmed, but the domain's persistence and active status warrant immediate containment. Further analysis of network traffic to 142.251.208.1 may reveal additional compromised endpoints or related campaigns.