Security Scan Report: psychotherapie-averdung.de

Submitted: Oct 12, 2026, 4:16:24 PMCompleted: Oct 12, 2026, 4:17:05 PMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Legitimate-looking German psychotherapy site that has been compromised: page injects ClickFix/EtherHiding loader and DarkSword iOS wallet-stealer exploit kit (kit-roster + YARA + 10 CRITICAL IDS alerts), with primary domain flagged as malware. Do not visit.

Risk Factors (5)
Compromised site injecting ClickFix / EtherHiding malware loader into the page (YARA + kit-roster confirmed)
DarkSword iOS exploit kit delivering the Coruna crypto-wallet stealer (fake captcha gate with hidden exploit iframe)
Primary domain flagged in threat intelligence as a malware loader
Multiple script/network requests to flagged third-party domains (zvh4.com, apiforxwork.com/.net, translatevv.com, sepolia.gateway.tenderly.co)
Page content is benign German psychotherapy copy, indicating a legitimate site that has been compromised rather than an overtly fraudulent one
Domain age information unavailable

Details

Page Title

Psychotherapie - Jasmin Averdung

Scan Type

public

Domain Name Analysis

Domain 'psychotherapie-averdung.de' uses the German country-code top-level domain (.de) and has no subdomain. The registrable portion 'psychotherapie-averdung' spans 23 characters holding eight vowels versus 14 consonants, plus 1 hyphen. Splitting it apart reveals seven words: psych, other, a, pie, a, verdun, g. The median word length lands at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://psychotherapie-averdung.de/

Page Load Overview

3.39s
Total Load Time
693 KB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:1,399 chars
Detector Agreement:100%

Website Classification

Primary Category

healthcare medical99% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

healthcare medical
99%
blog personal website
98%
government public service
91%
adult content
91%
education learning
87%

Detected Features

OG: article
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1182.165.77.53Germany
AS8560IONOS SE
4104.21.32.211Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
435.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
4172.67.187.123Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4104.16.184.241Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4104.16.185.241Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
398--

Detected Technologies7

WordPressv7.0.2
100%
JQueryv3.7.1
100%
50%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T176D3B552A1A588FD39DF9F784A1DA704610AD910C94127EAB5FDD0A877CCDBB40F3B0A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:SRdZzeJHQg5Mmjx+qehFP0xV2lgfoZ3bwemlUVugFm9TZIUgtlhJrYAIilQp+wv:SRdWQg5Mmjx+qehFP0xToZ3bwemlUVuT

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:134145:PBghoconLIgY4dIqKQCCAEWMAUkUpfgaIOpSYUMkAy5iMoE3R5uYbAAAEUAEi8QQNS6JSiCIaFAYI0oFRhCZocKhxUqCBACI

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:df0000ffdfffffff
Perceptual Hash:da7842bdb5c5434a
Difference Hash:3331a1353959c9e9
Wavelet Hash:0000008f87bfffff
Color Hash:#6fd22d

Scan History

Scan history not available

Unable to load historical scan data