myhermes[.]de-bcds[.]top

The domain myhermes.de-bcds.top was registered on 5 November 2025 through Dominet (HK) Limited and is served by the Alibaba Cloud DNS nameservers ns7.alidns.com and ns8.alidns.com. DNS resolution points to the IP address 34.107.215.64, an address owned by Google LLC (AS396982) located in the United States. No TLS certificate is presented for the host, indicating that the site is served over plain HTTP only. The page title returned by the server is "Hermes Paketversand", which does not match the advertised target brand. Threat intelligence flags the domain as a brand‑impersonation campaign aimed at the cryptocurrency platform Ankr, and the risk level is classified as elevated.

Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, currently blocked by the PhishDestroy service. VirusTotal analysis shows that two of ninety‑five scanned security vendors have flagged the domain as malicious. The site is presently taken offline, but the infrastructure components remain observable. The available evidence confirms a deliberate attempt to misuse the Ankr brand while presenting a misleading shipping‑related page title. The absence of a TLS certificate, the low trust score, and the detection by multiple security vendors suggest a low‑quality or rapidly abandoned phishing kit.

However, the limited number of blocklist listings and the small vendor detection count leave uncertainty about the campaign’s scale and whether additional payloads were delivered before takedown. Defenders should add the domain and its resolved IP address to network‑level deny lists, monitor DNS queries for the associated Alibaba Cloud nameservers, and enforce HTTPS‑only policies to prevent accidental connections to non‑TLS hosts. Continuous re‑scanning of the IP block for new domains registered with the same registrar or nameservers is advised, as is reviewing any outbound traffic to Google Cloud IP ranges that matches the observed patterns.