myhermes[.]de-edcg[.]top

The domain myhermes.de-edcg.top was observed hosting a page titled “Hermes Paketversand”. The site is currently offline, but historical data indicates it was used to impersonate the cryptocurrency staking platform ankr. The registration record shows the domain was created on 2025-11-04 and is registered through Dominet (HK) Limited, with authoritative name servers ns7.alidns.com and ns8.alidns.com. No TLS certificate was presented when the site was reachable, indicating the use of plain HTTP. Network resolution points to IP address 34.107.215.64, which belongs to AS396982 owned by Google LLC and is geolocated in the United States.

The same host appears on at least one public security blocklist and has been explicitly blocked by the PhishDestroy sinkhole. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analytics show that six of ninety‑five scanning engines flagged the domain, providing independent confirmation of suspicious behavior. The limited detection count suggests that the payload or phishing kit employed may be simple or newly observed, and no additional indicators such as malicious binaries or command‑and‑control traffic have been released publicly. Because the site is offline, real‑time probing is not possible, and the content of the landing page beyond the title has not been captured.

Defenders should continue to enforce domain‑based blocking for myhermes.de-edcg.top across DNS filtering, proxy, and endpoint controls. Monitoring of the associated IP address 34.107.215.64 for any future activity is recommended, as the same cloud infrastructure could be reused for other campaigns. Organizations that use ankr services should alert users to the possibility of credential‑stealing attempts that reference the Hermes Paketversand title, and consider adding ankr‑specific indicators to their threat‑intel feeds.