What Gridinsoft observed on Laengconsulting.ch
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260822212300-0e5b1e6e
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review supports a Safe classification for the reviewed laengconsulting.ch apex deployment. The fresh Gridinsoft scan retained an old domain signature but exposed no current positive first-party signal, while direct review of the complete public page, form, redirects, request profiles, and referenced code did not reproduce harmful behavior. Historical public intelligence records a real domain-level IClickFix incident signal, but no exact malicious URL, sample, payload, or hash was preserved, and later public scans show maintenance and rebuilt legitimate deployments. The unsupported current broad warning should therefore be removed while the historical incident and residual external reputation context remain documented separately.
Analyst findings
Review 7 documented observations View evidence
The current apex returned the expected Läng Consulting business site over HTTPS with HTTP 200. HTTP and www converged on the same HTTPS apex, and browser, mobile, crawler, and Gridinsoft request profiles received the same site structure without an unrelated destination.
-
HTTP status
200 -
Final URL
https://laengconsulting.ch/ - Analyst observation The only response differences among the four reviewed request profiles were ordinary per-response Akismet and translation-widget identifiers; the visible content, navigation, forms, and resources were otherwise the same.
- Page element The page identifies a Swiss digital agency and provides coherent service, company, telephone, email, and contact information at the same origin.
The public WordPress collection exposed one published page and no published posts. The reviewed root, form, navigation, and 64 referenced same-origin stylesheet or script assets did not reproduce a fake verification prompt, command-copy instruction, unrelated redirect, concealed executable, archive download, or automatic download.
- Analyst observation The high-signal code review found no current reference to PowerShell, cmd.exe, IClickFix, captcha-verification, clipboard APIs, script interpreters, executable installers, or the common command-launch utilities checked in the reviewed assets.
- Page element The public contact form posts to a same-origin Contact Form 7 endpoint and contains ordinary name, email, phone, subject, and message fields; no password, payment-card, recovery-phrase, executable-upload, or account-login field was present.
- Analyst observation The only live off-site page resources identified in the root source were Google font resources and a theme-demo background image; no reviewed resource produced an unrelated navigation or executable delivery flow.
A fresh supported Gridinsoft rescan reached the current site successfully. Before correction, it retained the stored September 2025 domain signature, but its current positive-signal list was empty and the report named no exact current malicious URL, redirect destination, file, payload, exploit, or hash.
-
HTTP status
200 - Analyst observation The retained Suspicious Website result came from a stored domain signature dated 2025-09-22; the fresh report exposed an empty positive-signal array.
The apex and www host resolve to the current Hostpoint deployment, and HTTPS presents a valid certificate for the apex. The exact reviewed host is the registrable parent domain itself; www redirects to that same object.
- DNS fact laengconsulting.ch resolves to 217.26.50.223 and 2a00:d70:0:b:2002:0:d91a:32df; www resolves to the same IPv4 address.
- Certificate fact The apex certificate is valid from 2026-07-04 through 2026-10-02.
- DNS fact Current public DNS exposes SPF and a DMARC quarantine policy. DKIM was not independently asserted because no selector or signed message header was available in the reviewed public material.
Public threat-intelligence records preserve a historical incident signal for the exact domain. A ThreatFox feed mirror dated 2026-02-12 labels laengconsulting.ch as an IClickFix botnet command-and-control domain with 75 percent confidence, and OTX indexes the domain in related IClickFix and botnet pulses. The reviewed records do not preserve an exact offending path, request transcript, file, payload, or hash.
- Public artifact URL https://radar.offseq.com/threat/threatfox-iocs-for-2026-02-12-acafb6eb
- Public artifact URL https://otx.alienvault.com/indicator/domain/laengconsulting.ch
- Analyst observation This is a historical exact-domain indicator, which is more specific than a generic current blacklist category, but it is not a preserved malware sample or exact malicious URL and does not reproduce current behavior.
The public urlscan index contains 15 results across the parent namespace. The October 2025 exact-root screenshot shows the earlier Läng Consulting business site, the 2026-02-20 exact-root screenshot shows a same-company maintenance page eight days after the threat-intelligence entry, and the 2026-08-11 exact-root screenshot shows the current rebuilt agency site. None of the indexed records preserved the February IClickFix path or a specific malware payload.
- Public artifact URL https://urlscan.io/result/0199c98a-ec43-773e-9b3a-0c73ebc0a8d0/
- Screenshot SHA-256 4198584c984815b43926f65b371bdb2d40c7764d9a6894d0bf096e18b21e2d1c
- Public artifact URL https://urlscan.io/result/019c7993-f38d-733f-b257-825a444b43af/
- Screenshot SHA-256 7541f776c753b069910a4d716189f61ea818cb007f875232779a4e4af7f59fa1
- Public artifact URL https://urlscan.io/result/019fef4c-120a-7119-9c9f-d99962cc1a66/
- Screenshot SHA-256 6ece8011ef38b721f48de4e212959c39519c0d7689e87a20f3a5e604b306977d
Wayback returned four distinct successful root snapshots from September 2022 through February 2025 but no capture covering the February 2026 threat-intelligence event. Public archive coverage therefore cannot reconstruct the exact historical path or behavior.
- Public artifact URL https://web.archive.org/web/20250202125926/https://laengconsulting.ch/
- Analyst observation No archived exact path, command sequence, executable, file hash, or payload associated with the February 2026 domain indicator was found in the reviewed public indexes.
Scope and limitations
- The verdict applies to the publicly reachable laengconsulting.ch apex deployment reviewed at the recorded time; it is not a guarantee about future content.
- The review did not access the private WordPress filesystem, database, administrator account, hosting control panel, scheduled tasks, mail server, or server logs.
- No public form was submitted, no account was created, no credential was entered, and no downloaded object was executed.
- The February 2026 threat-intelligence record preserves an exact-domain indicator but not the exact offending path, network transcript, malware bytes, file hash, or payload behavior.
- Public archive coverage did not include the February 2026 incident date and therefore could not reconstruct every historical server response.
- Current external warnings are separately controlled context and were not used to determine the Gridinsoft verdict.
Help protect others by sharing this page on social media! The more people who know about laengconsulting.ch, the fewer chances they have to deceive someone else. Help others evaluate laengconsulting.ch by sharing this page on social media!