Security Scan Report: krankengymnastik-seibel.de

Redirected to:
https://www.krankengymnastik-seibel.de/
Submitted: Completed: publiccompleted
This website contacted 16 IPs in 2 countries across 11 domains to perform 46 HTTP transactions. The main domain is krankengymnastik-seibel.de.

Submitted URL: https://krankengymnastik-seibel.de

Effective URL:
https://www.krankengymnastik-seibel.de/
Redirected

AI Security Verdict

High Risk

Confidence: 85%

8
Risk Score

Compromised-looking WordPress physiotherapy page whose scripts pull an EtherHiding loader from blockchain contracts and reach a known malicious host; no forms, but CRITICAL malware IDS alerts and loader indicators.

Risk Factors (5)
6 CRITICAL IDS alerts for EtherHiding payload exfiltration
Blockchain RPC / smart-contract domain resolution (getDomain()) from a healthcare site
Malicious secondary domain (checkyoubrowse.codes) loaded as page resource
Content-malware (loader) threat-intel match on the primary domain
1-day-old, unranked domain
Domain age information unavailable

Details

Page Title

Homepage - Praxis für Krankengymnastik

Scan Type

public

Domain Name Analysis

You're looking at domain 'krankengymnastik-seibel.de' on the German country-code top-level domain (.de). The core label 'krankengymnastik-seibel' covers 23 characters holding 7 vowels versus 15 consonants; bonus characters include one hyphen. Segmentation suggests seven words: kr, an, ken, gymnast, ik, sei, bel. Average segment length settles at three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://krankengymnastik-seibel.de

Page Load Overview

2.50s
Total Load Time
2.8 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:2,484 chars
Detector Agreement:100%

Website Classification

Primary Category

healthcare medical90% confidence
Type: spa
Method: ml+structural

All Detected Categories

healthcare medical
90%
blog personal website
65%
government public service
63%
finance banking
61%
adult content
50%

Detected Features

OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
16217.160.0.187Germany
AS8560IONOS SE
2142.251.13.95Google · CDNUnited States
AS15169Google LLC
2142.251.151.119Google · CDNUnited States
AS15169Google LLC
2104.17.208.5Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
235.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
2142.251.14.94Google · CDNUnited States
AS15169Google LLC
2142.251.13.94Google · CDNUnited States
AS15169Google LLC
2188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
4616--

Detected Technologies10

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1483385E36788473BB2940CD0B069B11B61B7D11BF9301199FBF69ADFB569E817430A32

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:tmrjooZ0WDXy0a3tAOVmitj24KMYH5Vq1qoJ2MA1EQ5eXyrT+yw/yH:sr0oZPXhPitVKMYH5Vq1qoJvA1T3H

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:51490:DBkjAwpIZGiLBCI1gsD4JuEAeqiJiSCAAhDYRCJoYYkGQBYHDIWxIACEylIQLIaoIdBlgBIQPsg2QGuC2NF8FglAqgQBuwhS

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Scan History

Scan history not available

Unable to load historical scan data