uphold-loogin[.]blogspot[.]se

Analysis of the domain uphold-loogin.blogspot.se indicates it is an active credential phishing site targeting users of the Uphold platform. The domain, hosted on Blogger infrastructure, resolves to 142.250.186.161 (Google LLC, US) and presents a page titled 'Uphold Login | Secure Access to Your Uphold Account,' suggesting an attempt to mimic the legitimate Uphold login portal. The domain is flagged by 9 of 95 security vendors in aggregated scans and appears on at least one security blocklist, with PhishDestroy currently blocking access. A 302 HTTP redirect is in place, a common tactic to obscure the final phishing endpoint or evade automated detection. Infrastructure analysis reveals the domain is registered through MarkMonitor, Inc., a legitimate registrar, but this does not mitigate the threat, as phishing actors frequently abuse reputable services. The SSL certificate is issued by Google Trust Services, providing HTTPS encryption, which attackers leverage to appear legitimate. Nameservers are standard Google DNS (ns1-4.google.com), consistent with Blogger-hosted domains. The domain was originally created in August 2005, but this long registration history is irrelevant to its current malicious use, as attackers often repurpose or squat on aged domains to exploit residual trust. The scam type is explicitly classified as credential phishing, with no evidence of additional payloads or secondary fraud stages (e.g., malware distribution or financial redirection). Defenders should treat this domain as high-risk and prioritize blocking at the DNS or network level. Users encountering this domain should avoid entering credentials and report the URL to their security team or the targeted brand. Further investigation is required to determine the final destination of the 302 redirect and whether collected credentials are exfiltrated to a command-and-control server or used in real-time account takeovers.