uphold-wallettt[.]blogspot[.]cz

This domain, uphold-wallettt.blogspot.cz, functions as a crypto drainer phishing site designed to compromise cryptocurrency wallet credentials and automatically siphon digital assets. Analysis indicates the domain specifically targets users through deceptive wallet interfaces, tricking victims into authorizing malicious transactions that transfer funds to attacker-controlled addresses without explicit consent. The infrastructure is engineered to exploit browser-based wallet integrations, particularly those using Web3 protocols, by mimicking legitimate wallet verification prompts or recovery flows. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., and resolves to IP address 142.250.201.65, hosted on AS15169 (Google LLC). The domain appears on three security blocklists and is flagged by 12 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence sources. Despite the creation date listed as February 21, 2026—a likely error in registration data—the domain was active during recent campaigns and has since been taken offline. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting users. Users who visited uphold-wallettt.blogspot.cz should immediately revoke any active wallet authorizations linked to the site, particularly those involving token approvals or transaction signing. All connected wallet addresses should be audited for unauthorized transactions, and remaining assets should be transferred to a new, secure wallet. Browser extensions and local storage should be cleared to remove any residual malicious scripts. Additionally, users are advised to monitor for follow-up phishing attempts via email or social engineering, as attackers may retain contact details obtained during the compromise.