Lions-hf.be Reputation Review

Fresh independent requests and the current Gridinsoft-owned scan reached the same Lions Club Hautes Fagnes homepage over HTTPS. Browser, crawler, and command-line request profiles returned identical page content, and the HTTP entry upgraded to the same HTTPS host.

• HTTP status 200
• Final URL https://lions-hf.be/
• Analyst observation The browser, crawler, and command-line request profiles returned identical current homepage content.
• Analyst observation No user-agent-dependent page replacement, unrelated redirect, or automatic download was reproduced.

All 49 unique French and German page URLs listed by the current public WordPress sitemaps were requested. Each returned HTTP 200 after at most one expected same-site account or logout redirect, and the reviewed pages presented the club, charitable works, activities, members, events, contact information, galleries, and account-related pages.

• HTTP status 200
• Public artifact URL https://lions-hf.be/wp-sitemap.xml
• Analyst observation 49 unique sitemap-listed page URLs were reviewed; all completed with HTTP 200 on lions-hf.be.
• Analyst observation No sitemap-listed page redirected to an unrelated host or linked an automatic executable download.

The public contact, member login, WordPress login, and password-reset surfaces used same-origin form actions. Four embedded member or voting endpoints returned a login-required message to an unauthenticated request. Direct requests for the environment file and XML-RPC endpoint returned HTTP 403.

• Public artifact URL https://lions-hf.be/contact/
• Public artifact URL https://lions-hf.be/login/
• Public artifact URL https://lions-hf.be/wp-login.php
• Analyst observation Reviewed forms submitted to lions-hf.be rather than an unrelated credential receiver.
• Analyst observation The reviewed unauthenticated member, committee, group, and voting embeds required a logged-in session.
• HTTP status 403

The reviewed pages and navigation were consistent with a bilingual Lions club site. External resources and links were limited to ordinary social, video, map, developer, and named charitable-partner destinations. No current deceptive credential receiver, injected gambling or cryptocurrency page, malicious payload, or automatic executable download was identified.

• Page element Lions Club Hautes Fagnes
• Analyst observation Current external destinations were consistent with Facebook, Vimeo, Google Maps, the credited site developer, and organizations named by the club's charitable-work pages.
• Analyst observation The reviewed current HTML contained no unrelated refresh redirect, executable download link, or reproduced malware-delivery action.

The apex and www host resolved to the same Infomaniak-hosted IPv4 and IPv6 service. The current TLS certificate covered both names, and DNS records included the site's mail service, SPF policy, and existing service-verification records.

• DNS fact A 185.125.27.26
• DNS fact AAAA 2001:1600:0:aaaa::80:16
• DNS fact MX mta-gw.infomaniak.ch
• Certificate fact The current certificate subject alternative names include lions-hf.be and www.lions-hf.be.

Public exact-host OSINT did not produce a current object-level malicious sample. URLScan listed two August root scans with HTTP 200, the expected club title, and no published verdict. OTX linked the domain to one bulk ThreatFix pulse containing more than thirty thousand indicators, but its matching entries were duplicate domain indicators without an exact URL, description, malware family, file, or behavior trace. Exact public sandbox and malware-index searches produced no indexed sample-level result.

• Public artifact URL https://urlscan.io/domain/lions-hf.be
• Public artifact URL https://otx.alienvault.com/indicator/domain/lions-hf.be
• Analyst observation URLScan returned two root observations from 2026-08-14 and 2026-08-15, both HTTP 200 with the expected club title and no published verdict.
• Analyst observation The matching OTX pulse supplied duplicate domain-only indicators and no exact harmful URL, payload, hash, receiver, malware family, or reproduced action.
• Analyst observation Exact public searches in ANY.RUN, Hybrid Analysis, Triage, URLhaus, and ThreatFox did not identify an indexed object for the reviewed host; some direct interfaces required authentication, so this is not a completeness claim.

The public archive returned 256 distinct successful HTML captures from July 2021 through May 2026. Sampled 2021 and 2026 homepages showed the Lions club site and expected social content rather than a malicious campaign. The archive had no capture after May 2026, so it cannot verify the reported later compromise or the cleanup date.

• Public artifact URL https://web.archive.org/web/*/https://lions-hf.be/
• Analyst observation The archive index contained 256 distinct HTTP-200 HTML captures from 2021-07-29 through 2026-05-16.
• Analyst observation Representative 2021 and 2026 homepage captures showed the Lions Club Hautes Fagnes site.
• Analyst observation No archive capture after 2026-05-16 was available to establish the later compromise or cleanup timeline.

The review covered the current public bilingual sitemap, key forms, unauthenticated member embeds, redirects, DNS, TLS, public indexes, and representative archives. It did not sign in, submit personal data or credentials, inspect server files, prove the historical compromise, or certify future content.

• Analyst observation No credentials, personal data, contact message, registration, or password-reset request was submitted.
• Analyst observation Authenticated member-only behavior, undisclosed URLs or subdomains, server-side files, and future changes remain outside the reviewed scope.
• Analyst observation Public OSINT and archive indexes are incomplete; the absence of a public object does not prove that no historical compromise occurred.