Security Scan Report: medien-meinungen.de

Site favicon
Submitted: Oct 1, 2026, 1:05:01 PMCompleted: Oct 1, 2026, 1:06:10 PMpubliccompleted

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

Legitimate-looking German media blog, but CRITICAL EtherHiding malware IDS alerts plus blockchain RPC and ClearFake/ClickFix threat intel indicate the site is compromised and serving injected malicious script.

Risk Factors (5)
CRITICAL IDS malware alerts for EtherHiding exfiltration (4 events)
Blockchain RPC connections from page scripts (drainer/EtherHiding delivery pattern)
Primary domain listed with a malware (ClickFix/iclickfix) indicator
Third-party resource IP flagged as ClearFake exploit kit by two feeds
Dynamic Function() code generation with an unranked third-party script host
Domain age information unavailable

Details

Page Title

Medien | Meinungen – Der Blog des Instituts für Medienverantwortung

Scan Type

public

Domain Name Analysis

The domain 'medien-meinungen.de' uses the German country-code top-level domain (.de) and has no subdomain. The registrable portion 'medien-meinungen' spans 16 characters holding seven vowels versus eight consonants; it also includes one hyphen. Tokenizing the label suggests five words: me, dien, mein, un, gen. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://medien-meinungen.de/

Page Load Overview

7.86s
Total Load Time
4.6 MB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:6,999 chars
Detector Agreement:100%

Website Classification

Primary Category

forum50% confidence
Type: dynamic
Method: structural

All Detected Categories

forum
50%

Detected Features

Comments

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1285.13.163.35Germany
AS34788Neue Medien Muennich GmbH
5172.217.208.95Google · CDNUnited States
AS15169Google LLC
5188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
535.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
5178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
478--

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T13F5397734088056E930AB7C9C490372DD0578A3BDA412A52B7BB2D86AFC1FF2257677D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:hVap2hpo+elqyFPiLaZ1uH2PZUfcuv5xy4z+Hc:hEsp1elqy8LajuHU6y4yHc

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:62567:eRgJBYw0xmCVAA5BoECAAOFBxwQqEDDmASBw5p0LGSewAiEMCEIEkysEEND5IQZCRBhRAUDiJPrYkw8AeYiBKAEcgGGFAAfb

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00c3f7c7c7ffdfff
Perceptual Hash:bc7c1d19161a474f
Difference Hash:3c362e2e2e123e36
Wavelet Hash:008393c3c3cbcbdf
Color Hash:#c3c587

Scan History

Scan history not available

Unable to load historical scan data