z[.]lqhub[.]company

Analysis of the domain z.lqhub.company, created on December 09, 2025 and currently offline, shows infrastructure characteristics typical of malicious phishing operators. The domain is registered through NiceNIC International Group Co., Limited and uses Cloudflare’s DNS service (curt.ns.cloudflare.com, bingo.ns.cloudflare.com). DNS resolution points to the IP address 172.67.191.13, which belongs to AS13335 Cloudflare, Inc., a frequent hosting provider for abused domains because of its ubiquitous CDN and anonymity features. No TLS certificate is presented, indicating that the site either does not serve HTTPS or was taken down before a certificate could be issued. Reputation services flag the domain as malicious.

It appears on the PhishDestroy blocklist, and four of ninety‑five VirusTotal scanners have raised detections, confirming that at least a subset of security vendors consider the domain suspicious. The Gridinsoft trust score is 0 out of 100, reinforcing the low confidence in the site’s legitimacy. No Safe Browsing or Open Threat Exchange (OTX) entries are disclosed in the supplied intelligence. Because the site is offline, HTTP status codes cannot be verified, and the page title or any brand‑specific content has not been captured.

Consequently, the exact phishing lure (e.g., credential‑stealing login page) remains unconfirmed. Nevertheless, the combination of a recent registration date, Cloudflare hosting, absence of SSL, low trust rating, and inclusion on a known phishing blocklist aligns with patterns observed in credential‑harvest campaigns. Defenders should proactively block z.lqhub.company at network perimeter and DNS layers, add the domain to internal threat‑intel feeds, and continue monitoring for any re‑appearance on other blocklists or detection platforms.