myhermes[.]de-mder[.]top

Analysis of the domain myhermes.de-mder.top, observed as offline on July 25, 2026, indicates a clear brand impersonation campaign targeting the Ankr brand. The site was registered on November 5, 2025 through Dominet (HK) Limited, and its authoritative name servers are ns7.alidns.com and ns8.alidns.com. DNS resolution points to the IP address 34.107.215.64, which belongs to Google LLC (AS396982) and is geolocated in the United States. No TLS certificate is present, meaning any HTTP connection would be unencrypted.

Threat intelligence from VirusTotal shows that 7 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion of malicious intent. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one known security blocklist, where it is listed as blocked by PhishDestroy. The page title retrieved from the site is "Hermes Paketversand," a reference to a shipping service, yet the listed impersonated brand is Ankr, suggesting a possible credential‑stealing front that leverages familiar logistics terminology to lure victims. While the exact content of the hosted page has not been examined, the combination of a low trust score, multiple vendor detections, and blocklist inclusion provides strong evidence of a phishing or credential‑harvesting operation.

Defenders should continue to block the domain at perimeter filters, monitor for any DNS queries to the associated IP range, and consider adding the domain to internal blacklists. Additional investigation of any outbound traffic to the IP address may reveal compromised hosts. Because the site is currently offline, any active malicious payloads are likely dormant, but the infrastructure remains usable for future campaigns, so ongoing vigilance is recommended.