uphold-loginaccount[.]blogspot[.]dk

This domain, uphold-loginaccount.blogspot.dk, is actively flagged as a high-risk credential phishing site targeting users of a financial services platform. Infrastructure analysis reveals the domain is hosted on Blogger infrastructure, resolving to the IPv6 address 2a00:1450:4001:82b::2001, which is associated with Google's content delivery network. The SSL certificate is issued by Google Trust Services, a common characteristic of legitimate and malicious sites alike, and does not mitigate the threat. The domain was registered on May 23, 2011, through MarkMonitor, Inc., though the age of the domain is not indicative of legitimacy in this context, as subdomains on Blogger can be created and weaponized rapidly. The page title, 'How Can You Securely Access Your Uphold Login Account?', explicitly references a login process for a financial platform, a tactic commonly employed to deceive users into entering credentials. While the exact content of the page has not been analyzed, the title and known threat type strongly suggest an attempt to harvest login credentials. Eight of ninety-five security vendors on VirusTotal have flagged this domain, and it appears on at least one security blocklist, specifically PhishDestroy. Technologies detected on the domain include Blogger, Java, Python, OpenGSE, and HTTP/3, which are consistent with both legitimate and malicious sites hosted on Google's infrastructure. Defenders should treat this domain as an active threat. Network-level blocking is recommended, particularly for organizations in the financial sector or those with users who may interact with the targeted brand. Given the domain's presence on a blocklist and the detection by multiple security vendors, automated remediation tools should prioritize this indicator. Further investigation into the hosting infrastructure and any associated domains may reveal additional phishing campaigns.