myhermes[.]de-kdif[.]top

Analysis of the domain myhermes.de-kdif.top indicates a confirmed brand impersonation campaign targeting Ankr, a blockchain infrastructure provider. The domain was registered on November 5, 2025, through Dominet (HK) Limited and resolved to the IP address 34.107.215.64, hosted on Google LLC’s infrastructure (AS396982) in the United States. No SSL certificate was detected, increasing the risk of unencrypted data transmission. The page title, 'Hermes Paketversand,' suggests an attempt to mimic a logistics or parcel delivery service, a common tactic in phishing operations to deceive users expecting package notifications.

Infrastructure analysis reveals the domain used nameservers ns7.alidns.com and ns8.alidns.com, which have been associated with other malicious domains in prior investigations. At the time of assessment, the domain was offline, though it had been flagged by one security blocklist and detected by 7 of 95 security vendors on VirusTotal. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. While the exact content of the site remains unanalyzed, the combination of brand impersonation, absence of SSL, and detection by multiple vendors confirms its fraudulent intent.

Defenders should treat this domain as a high-risk indicator of compromise (IOC). Network-level blocking is recommended for the domain and its associated IP address. Organizations should also monitor for related domains registered through Dominet (HK) Limited or utilizing Alibaba Cloud nameservers, as these may indicate further impersonation attempts. Given the domain’s current offline status, no live threat is present, but historical logs should be reviewed for prior connections.