myhermes[.]de-vxdg[.]top

The domain myhermes.de-vxdg.top was registered on 5 November 2025 through Dominet (HK) Limited and is hosted on a Google Cloud infrastructure identified as ASN 396982, United States. DNS resolution points to the IP address 34.107.215.64, and the authoritative name servers are ns7.alidns.com and ns8.alidns.com. No TLS certificate is present, indicating the site operated without HTTPS encryption. The page title returned by the server is "Hermes Paketversand," while the intelligence profile lists the brand target as ankr, indicating the domain was being used to impersonate ankr‑related services.

The domain appears on a single security blocklist and has been specifically blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis shows that six of ninety‑five scanning engines flagged the domain as malicious, providing additional corroboration of malicious intent. The site’s current status is offline, but historical evidence suggests it was used for brand impersonation, likely to lure victims into disclosing credentials or personal information under the guise of a reputable service.

Defenders should continue to monitor the IP address and associated name servers for any re‑use, update URL filtering rules to include the domain and its hosting subnet, and ensure that any security appliances that reference blocklist entries are refreshed to capture this indicator. Because the page content beyond the title has not been publicly disclosed, further forensic capture of the site while it was active would be required to confirm the exact phishing payload or credential‑harvesting mechanisms employed. In the interim, organizations should educate users about unsolicited communications referencing Hermes Paketversand or ankr, advise verification through official channels, and enforce multi‑factor authentication to mitigate potential credential compromise.