z[.]lqhub[.]info

Analysis on July 24, 2026 indicates that the domain z.lqhub.info is currently offline but continues to exhibit characteristics associated with a generic phishing operation. The site resolves to the IP address 172.67.218.48, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. No SSL certificate was presented during the last HTTP request, and the HTTP response returned the page title “Index of /”, a generic directory listing that offers no functional content. The domain was registered through Cloudflare, Inc., suggesting the use of Cloudflare’s registrar and protection services.

Threat intelligence from VirusTotal shows that eleven of ninety‑five scanning engines flagged the domain as malicious, confirming a consensus of suspicion among security vendors. PhishDestroy has listed the domain as blocked, and it appears on one additional security blocklist. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the assessment of high risk. The lack of a valid TLS certificate combined with the empty directory listing further reduces the credibility of any legitimate service.

Given the observed indicators, defenders should continue to deny any network traffic to 172.67.218.48 associated with z.lqhub.info, enforce DNS sink‑hole rules for the domain, and update intrusion‑prevention signatures to reflect the current threat profile. Continuous monitoring of the domain’s registration status and any future re‑activation is recommended, as the underlying hosting provider could be leveraged for new malicious campaigns. Organizations that have previously blocked the domain through web‑filtering or endpoint solutions should verify that the block remains in place, even while the site is offline, to prevent accidental re‑exposure.