connect-uphold-login-account[.]blogspot[.]lt

The domain connect-uphold-login-account.blogspot.lt is currently classified as a credential phishing site targeting users of the Uphold service. The site presents the page title “How Can You Safely Access Your Uphold Login Account?” and returns an HTTP 302 redirect, indicating the presence of a redirection mechanism typical of credential‑stealing operations. The SSL certificate presented is issued by Google Trust Services / WE2, confirming that the site is hosted on Google’s infrastructure and is reachable over HTTPS. Network analysis shows the domain resolves to the IP address 216.58.212.129, which belongs to AS15169 owned by Google LLC and is physically located in the United States. The domain was registered on 7 December 2018 through MarkMonitor, Inc., and uses Google’s authoritative name servers (ns1‑ns4.google.com). The hosting environment reports the presence of Blogger, Java, Python, OpenGSE, and HTTP/3, consistent with a typical Google Blogger deployment that has been repurposed for malicious content. VirusTotal has flagged the domain in 7 out of 95 security vendor scans, and it appears on one public blocklist. The site is also listed as blocked by PhishDestroy, providing additional confirmation of its malicious nature. Despite these indicators, the domain remains active as of the report date, and no further public intelligence describing the exact payload or credential capture mechanism has been disclosed. Defenders should block DNS resolution for the domain and enforce HTTPS inspection to detect the 302 redirect. Email security gateways should be configured to flag messages that reference the domain or the exact page title, and users should be educated to avoid clicking links that claim to provide “safe access” to Uphold accounts. Continuous monitoring of the associated IP and the Google name‑server range is advised, as the infrastructure can be reused for future campaigns.