myhermes[.]de-xdfh[.]top

This domain was observed by PhishDestroy and subsequently taken offline. The fully qualified domain name myhermes.de-xdfh.top was registered on 2025-11-05 through Dominet (HK) Limited. DNS resolution points to IP 34.107.215.64, which belongs to Google LLC (AS396982) and is geolocated in the United States. No TLS certificate was presented, indicating the site operated over plain HTTP.

The page title returned by the server is "Hermes Paketversand", and the campaign is classified as brand impersonation targeting the cryptocurrency platform ANKR. The domain appears on a single security blocklist and has been flagged by five of ninety‑five VirusTotal scanners. Independent analysis by Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious nature of the infrastructure. Authoritative name servers ns7.alidns.com and ns8.alidns.com were observed serving the zone.

Although the site is currently offline, the combination of registrar choice, hosting on a major cloud provider, lack of encryption, and low trust score suggests a deliberate attempt to lure victims with a shipping‑related lure while stealing credentials or funds related to ANKR. Defenders should continue to block the IP address 34.107.215.64, add the domain to internal blocklists, monitor for any resurgence of the same registrar or name‑server pair, and enforce strict TLS‑only policies for outbound connections. Ongoing threat‑intel feeds should be consulted for potential reuse of the infrastructure in future campaigns.