ScanMalware.com

Security Scan Report: wandelphase.de

Site favicon
Submitted: Sep 19, 2026, 6:47:26 PMCompleted: Sep 19, 2026, 6:47:44 PMpubliccompleted

AI Security Verdict

High Risk

Confidence: 80%

8
Risk Score

Legitimate-looking German WordPress psychotherapy site with no credential forms, but a CRITICAL ET MALWARE EtherHiding alert, blockchain RPC C2 traffic, and a primary-domain malware-loader indicator point to a compromised site distributing malware.

Risk Factors
Critical ET MALWARE network alert (EtherHiding Exfil) on the page session
Observed blockchain RPC domain traffic (gateway.tenderly.co) consistent with hidden C2/exfil
Primary domain flagged as a malware loader by threat intelligence
Malware-flagged third-party resource qaz0.com loaded by the page
Compromised-WordPress malware injection pattern
Domain age information unavailable

Details

Page Title

Wandelphase – Eine andere WordPress-Site.

Scan Type

public

Domain Name Analysis

The domain 'wandelphase.de' uses the German country-code top-level domain (.de). The second-level label 'wandelphase' is 11 characters long containing four vowels alongside 7 consonants. Tokenizing the label suggests three words: wan, del, phase. Median word length comes out to three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://wandelphase.de

Page Load Overview

1.31s
Total Load Time
1.3 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:1,692 chars
Detector Agreement:75%

Website Classification

Primary Category

adult content45% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

adult content
45%

Detected Features

Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
981.169.145.150Germany
AS6724Strato GmbH
835.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
8188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
253--

Detected Technologies8

WordPressv7.1
100%
MetaGenerator
100%
JQueryv3.7.1
100%
PHP
50%
MySQL
50%
UNIX
40%
WordPress Site Editor
30%
WordPress Block Editor
30%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15163C772937495F07E5EC73A5A8AB25C3A58B612CB0363D1F0A5D1146ACE5F708E2F0B

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:2dUqQm0PIlGDzHz8CMe9ihphyOKZXkWP+/AylU0b0vmdNJ6Ih7ZrTZdSZUaAsnfC:2mqQmsSGDjAx5KZH+b0ObZdyp1FC6TF4

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:72689:ETKQwSwlEMAlaMQJbHY5UuTAIYBUIAAaIY0cRBE2ACUQpkAyPalCItSypRRSGAHA8YTbAABeQCJgI6JBSKGqSMAMEdytM4aY

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fffff3f3fbf3f700
Perceptual Hash:ecb6138d38e4469b
Difference Hash:262a6727926627d9
Wavelet Hash:c3e2f1c1c3f3f300
Color Hash:#be79d2

Other Hashes

Crop Resistant:262a6727926627d9,538f27150b5a5330,c1a501c367071717,00042c0acccc2c0c

Scan History

Scan history not available

Unable to load historical scan data