myhermes[.]de-jufk[.]top

The domain myhermes.de-jufk.top was registered on November 5, 2025 through Dominet (HK) Limited and is currently taken offline. Infrastructure analysis shows the domain resolves to the IP address 34.107.215.64, which is owned by Google LLC (AS396982) and geolocated in the United States. The domain is served by the authoritative name servers ns7.alidns.com and ns8.alidns.com, and no SSL certificate is presented, indicating an unencrypted HTTP service. The page title returned from the live host before takedown was "Hermes Paketversand," a phrase unrelated to the targeted brand, which is identified as ankr in the intelligence feed.

The site has been classified as a brand impersonation campaign aimed at ankr, and it has been blocked by the PhishDestroy mitigation service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis reports that nine out of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious activity. The domain appears on a single security blocklist, further confirming its adverse reputation.

While the exact payload or credential‑harvesting mechanisms have not been publicly disclosed, the combination of a low trust score, multiple vendor detections, and the presence on a blocklist suggests the domain was likely used to lure victims under the guise of a legitimate service. Defenders should continue to block the domain at perimeter and DNS layers, monitor traffic for any residual connections to the IP 34.107.215.64, and update internal threat intel repositories with the associated indicator set. Ongoing observation of the registrar Dominet (HK) Limited and the Alidns name server infrastructure is advised, as these components have been reused in prior impersonation campaigns.