There are some public German schools in this document. No way they would install that miner on their own. Looks like a portion of the sites are hacked to run the scripts.

Edit: reading through all .de domains at least 80% (or more) have no intention or technical ability to install this on their own, e.g. schools, craftsmen, small businesses, etc.

A lot of them probably run an outdated Joomla.

That's... a lot more than I expected TBH. Looks more like a list of sites to straight up block since most look like scam domains.