There are some public German schools in this document. No way they would install that miner on their own. Looks like a portion of the sites are hacked to run th

There are some public German schools in this document. No way they would install that miner on their own. Looks like a portion of the sites are hacked to run the scripts. Edit: reading through all .de domains at least 80% (or more) have no intention or technical ability to install this on their own, e.g. schools, craftsmen, small businesses, etc.