myhermes[.]de-mgrs[.]top

The domain myhermes.de-mgrs.top was registered through Dominet (HK) Limited on 5 November 2025. It resolves to the IPv4 address 34.107.215.64, which belongs to AS396982 owned by Google LLC and is geolocated in the United States. The authoritative nameservers are ns7.alidns.com and ns8.alidns.com. No TLS certificate is presented, indicating that the site operated only over HTTP.

The page title returned from the live host was "Hermes Paketversand", suggesting an attempt to imitate a German parcel service, while the underlying campaign targets the cryptocurrency platform Ankr, as indicated by the brand impersonation label. The domain has been assigned a Gridinsoft trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal scans show that six of ninety‑five security vendors flagged the domain, confirming the presence of malicious indicators. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy sinkhole, after which its status was changed to offline.

The combination of a low trust score, lack of SSL, association with a known brand target, and multiple vendor detections aligns with the classification of a brand‑impersonation phishing infrastructure. Defenders should continue to block the domain at perimeter firewalls, update URL filtering lists, and monitor for any re‑registration attempts. Incident response teams should also inspect any logs for connections to 34.107.215.64 and consider adding the IP to deny‑list rules, given its association with malicious activity. Ongoing intelligence collection is recommended to verify whether the infrastructure is being reused with a different domain or hosting provider.