ScanMalware.com

Security Scan Report: webfischerei.de

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/fa44805e-9522-47be-894e-5a2201b13a20Domain and IP registration (RDAP)/api/v1/rdap/fa44805e-9522-47be-894e-5a2201b13a20How often this domain was scanned/api/v1/domain/stats/webfischerei.deScan history for this domain/api/v1/domain/history/webfischerei.de?limit=15
This website contacted 4 IPs in 2 countries across 3 domains to perform 18 HTTP transactions. The main domain is webfischerei.de.

Submitted URL: https://webfischerei.de

AI Security Verdict

High Risk

Confidence: 92%

8
Risk Score

Legitimate-looking German local-journalism WordPress site that is serving an injected ClickFix/EtherHiding payload; the page itself has no credential form, but the loaded script is confirmed malware.

Risk Factors (5)
Critical YARA detection of a ClickFix Win+X / Terminal overlay loader injected into the page
Blockchain-backed (EtherHiding) payload staging with CRITICAL IDS malware alert
Obfuscated JavaScript concealing malicious RPC endpoints from static inspection
Unranked third-party script host cloud-browse.codes flagged as malware distribution by multiple feeds
Compromised-site pattern: legitimate German local-journalism WordPress content alongside attacker-injected script
Domain age information unavailable

Details

Page Title

Start - webfischerei

Scan Type

public

Domain Name Analysis

The domain name 'webfischerei.de' uses the German country-code top-level domain (.de). Its registrable label 'webfischerei' stretches across 12 characters split between 5 vowels and 7 consonants. Tokenizing the label suggests 3 words: web, fischer, ei. Median word length comes out to three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://webfischerei.de

Page Load Overview

6.59s
Total Load Time
568 KB
Total Size

Language Analysis

Primary Language

🇩🇪German
Code: de
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:de
Text Length:2,645 chars
Detector Agreement:100%

Website Classification

Primary Category

news media journalism94% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

news media journalism
94%
social media network
59%
corporate
25%
news/blog
20%

Detected Features

Search
Articles
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
692.204.90.124Germany
AS21499Host Europe GmbH
4104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
4172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
184--

Detected Technologies4

WordPressv7.0.7
100%
Open-Graph-Protocolvwebsite
100%
MetaGenerator
100%
JQueryv3.7.1
100%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1BDA36263A384033FB3C94ED49144711B51E6F51BE820615EFBE296EFB91CC923479A3A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:gHZ1cyp8wWv4dAQUHq3vQdkt/+vtykUSmpTIDM:gHZ1tNdAaQO0CpJ

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:104688:pBJEsCAU3ccYhEBRXkWCgBSgAwRhOqpRAsYKMkBkAECgAm1gQXAUhEvAgkSAtAqWTMugDSxrSAgliGgAKAjLMwCBgJyLKEOg

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffe7ff4945454125
Perceptual Hash:b3cece310c8c9d33
Difference Hash:700c0c11191b1d4d
Wavelet Hash:ffe7ffe101010101
Color Hash:#c7e06c

Other Hashes

Crop Resistant:700c0c11191b1d4d

Scan History

Scan history not available

Unable to load historical scan data