ScanMalware.com

Security Scan Report: kg-werbung.de

Site favicon
Submitted: Completed: publiccompleted

AI Security Verdict

High Risk

Confidence: 80%

8
Risk Score

Legitimate-looking German signage site whose domain is flagged as ClearFake malware by 2 intel feeds and whose scripts contact BSC testnet RPC nodes typical of wallet drainers — likely a compromised site; do not interact.

Risk Factors (3)
Multi-source threat-intel match for the 'clearfake' malware family on the primary domain
Browser scripts contact eight BSC testnet blockchain RPC nodes — characteristic of wallet-drainer/ClearFake injection
Hidden link block pointing to 21 unrelated external domains (injected link spam)
Domain age information unavailable

Details

Page Title

Kwiatkowski wir leben Werbung , für Ihren erfolg!

Scan Type

public

Domain Name Analysis

Within the German country-code top-level domain (.de), 'kg-werbung.de' is registered without a subdomain. Count 10 characters in 'kg-werbung' split between 2 vowels and seven consonants; it also includes 1 hyphen. Word splitting yields 3 words: kg, wer, bung. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://kg-werbung.de

Page Load Overview

0.99s
Total Load Time
829 KB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:43%
Script:Latin
Direction:ltr

Detection Details

Text Length:11,079 chars
Detector Agreement:80%

Website Classification

Primary Category

documentation technical89% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

documentation technical
89%
technology software
43%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
9212.172.221.6Bremen, Baden-Wurttemberg, Germany
AS12312ecotel communication ag
315.197.152.159Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
33.33.196.84Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
3104.20.46.180Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3142.215.53.55Washington, District of Columbia, United States
AS15830Equinix (EMEA) Acquisition Enterprises B.V.
335.71.129.99Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
3104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
315.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
308--

Detected Technologies6

MetaGenerator
100%
LiteSpeed
40%
HTTP/3
40%
HSTS
40%
jQuery
20%
Lightbox
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1EE943922445E0DBEC1BF514271158F9F205BCBCBA356AD04DABBA422E2CEDD4DD1DAE0

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:CW8w30kETIK7lCWRqQhH/cR0agPuWRNyvlLdHQLCI9eTeKFX2tyj7KW36V2NL7Tq:e7tZhU1uNOQLKiE2Ah36VwL7FYuIDans

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:416474:qwAKCJTYIE6RiYRZACgKEBIQASgJCCnDARNiwEAHMIFBkBhPkBcFUkfTEACQLoAaq1BHIAghxBIAdhAgMGGcAgMJgtBQniIs

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Scan History

Scan history not available

Unable to load historical scan data