What Gridinsoft observed on stimmt.ch
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260830233755-15b1f0de
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review did not reproduce malicious behavior on stimmt.ch. A broad suspicious classification is not supported by the reviewed present-day site, redirect, navigation, script, form, download, DNS, TLS, or public-archive evidence.
Analyst findings
Review 5 documented observations View evidence
The HTTP root redirected once to the HTTPS root, and the HTTPS root returned the expected Stimmt AG website. Desktop, mobile, search-crawler, and security-scanner user agents received the same final URL and identical response content.
-
HTTP status
200 -
Final URL
https://stimmt.ch/ -
Redirect destination
https://stimmt.ch/ - File SHA-256 05458a69fd653991c97722ad723ef30ea3849c985243e71b7a352e2eb7c91cf2
- Analyst observation Twelve root requests across four user-agent profiles and three URL variants converged on the same HTTPS document without cloaking or an unrelated redirect.
A bounded crawl reviewed 141 public URLs selected from 184 URLs discovered through the current sitemap. All reviewed pages returned HTTP 200. No meta-refresh, password or file-upload form, executable/archive download link, or unexpected off-site redirect was identified in the reviewed pages.
-
HTTP status
200 - Public artifact URL https://stimmt.ch/sitemap_index.xml
- Analyst observation 141 reviewed URLs returned HTTP 200; 140 distinct successful response bodies were observed.
- Analyst observation No executable or archive download reference, meta-refresh, password input, or file-upload input was found in the reviewed public pages.
The reviewed first-party scripts and inline configuration supported the site's presentation, analytics, forms, and cookie-consent functions. The observed base64 decoding was part of the cookie-consent configuration and did not expose a payload, automatic download, or unrelated navigation target.
- Page element Real Cookie Banner consent configuration
- Analyst observation Thirteen script resources referenced by the reviewed pages were fetched and inspected.
- Analyst observation No script reference to an executable payload or an unrelated forced-redirect destination was identified.
The root and www hostnames resolved consistently to the current hosting service, and the reviewed redirects remained within stimmt.ch. TLS was available for the public HTTPS endpoint.
- DNS fact stimmt.ch and www.stimmt.ch resolved to 185.175.196.26 and 2a00:1c98:60:1040::2643:bada.
- DNS fact Authoritative nameservers: ns.hostpoint.ch, ns2.hostpoint.ch, ns3.hostpoint.ch.
- Certificate fact The reviewed HTTPS endpoint negotiated a valid TLS connection for stimmt.ch.
- Analyst observation No off-site redirect was observed for the root or www hostnames.
Public archive indexes confirmed a long-running business website and recent WordPress content. The reviewed index results did not identify an archived executable payload URL. The exact object involved in the reported earlier compromise was not available in the ticket or public index results reviewed.
- Public artifact URL https://web.archive.org/cdx/search/cdx
- Analyst observation The recent archive query returned 730 distinct URL records covering public pages and normal web assets.
- Analyst observation No archived URL ending in exe, msi, apk, scr, iso, jar, ps1, bat, cmd, zip, rar, or 7z was identified in the reviewed recent results.
- Analyst observation No exact historical malicious URL, file, payload, or hash was supplied with the review request.
Scope and limitations
- The review covers the unauthenticated public website and the sampled public URLs available at the recorded time.
- The exact URL or file from the reported earlier compromise was not supplied, so this review does not reconstruct or dispute the historical incident; it determines the current public behavior and whether a current harmful object can be reproduced.
Help protect others by sharing this page on social media! The more people who know about stimmt.ch, the fewer chances they have to deceive someone else. Help others evaluate stimmt.ch by sharing this page on social media!