Dear Benoit

Best report phish to antiphising.ch, that’s the fastest way to get it to Swiss phish lists and blocked. And in case of a .ch also to the registry for a takedown.

As Rainer stated it is already in our and most likly other ISPs list by now. You can also check yourself i.e. with quad9

https://quad9.net/result/?url=breitband.drops.sh#domain-tester

Michael

On 27 Oct 2026, at 21:21, Rainer Duffner via swinog swinog@lists.swinog.ch wrote:

...

Am 27.10.2026 um 16:56 schrieb Benoit Panizzon via swinog swinog@lists.swinog.ch:

Hi

I was on contact with the Sales in charge of ISP contacts in Switzerland during the AWS summit Zürich and he recommended we contact his team in case of issues with abuse desk in the US.

Can't find any phone number for Sales Switzerland. Cloudflare Germany only Voicemail.

We have an actual issue of well made phishing site targeting specifically our customers.

If anyone else wants to help getting this removed / listed as phish: https://breitband.drops.sh/

Well, it’s listed now….

I guess you could have contacted SWITCH, too, so they put it on their RPZ feed?

I believe they usually share their intel and it ends up on everyone’s list after a while.

If only people hadn’t started to use the sh TLD for piping URLs directly into bash scripts, one could just block that TLD altogether….

---

swinog mailing list -- swinog@lists.swinog.ch To unsubscribe send an email to swinog-leave@lists.swinog.ch

------------------------------------ Michael Hausding Registry Domain Security Security Engineer D +41 44 268 15 77 T +41 44 253 12 34

Werdstrasse2, 8004 Zurich, Switzerland

https://switch.ch https://swit.ch/linkedin https://swit.ch/instagram