xqu[.]ytq[.]mybluehost[.]me

This domain, xqu.ytq.mybluehost.me, is actively flagged for high-risk brand impersonation targeting Facebook. Analysis indicates the infrastructure has been in place since October 5, 2016, and remains operational as of July 12, 2026. The subdomain resolves to the IP address 50.6.253.218 and is hosted on a platform associated with Bluehost, utilizing a combination of Nginx, Apache HTTP Server, WordPress, MySQL, PHP, and Yoast SEO technologies. The presence of these technologies suggests a structured web environment, likely leveraging a content management system to facilitate the phishing operation. The domain is currently detected by 14 out of 95 security vendors on VirusTotal, a signal of confirmed malicious activity. Additionally, it appears on at least one security blocklist and has been specifically blocked by a threat intelligence feed. The page title, 'Home - Lowser,' does not align with legitimate Facebook branding, further supporting the classification of this domain as part of a phishing campaign. The SSL certificate issued by Let's Encrypt provides encryption but does not mitigate the underlying malicious intent, as fraudulent sites commonly use valid certificates to appear legitimate. What remains uncertain is the full scope of the campaign, including whether this domain is part of a larger network of phishing sites or operates independently. The long-standing registration date may indicate either persistent abuse of an older domain or a more recent compromise of existing infrastructure. Defenders should treat this domain as an active threat, particularly in environments where Facebook credentials are a priority for protection. Network-level blocking of the IP 50.6.253.218 and monitoring for related subdomains under mybluehost.me are recommended actions. Given the high-risk classification, immediate containment measures should be prioritized to prevent credential theft or further exploitation.