rhoneswiss[.]online

PhishDestroy identifies an active credential harvesting scam operating under the domain rhoneswiss.online, currently impersonating Swiss banking services to deceive unsuspecting users. This elevated-risk threat remains active as of the latest assessment, with threat actors leveraging the domain to harvest sensitive login credentials under false pretenses. Users are strongly advised to exercise extreme caution when encountering this domain or any associated communications.

This domain was flagged by 1 of 95 VirusTotal security vendors, indicating minimal but notable detection across industry-standard threat intelligence platforms. The domain rhoneswiss.online was registered through GMO Internet, Inc., resolves to the IP address 198.251.84.200, and was created on June 29, 2025. Despite its recent registration, the domain exhibits several red flags, including low trust scores and limited historical legitimacy. The minimal VirusTotal detection rate suggests that broader threat intelligence networks may not yet have fully cataloged this threat, increasing the risk of exposure for unaware users.

Given the elevated risk level and the domain’s active status, PhishDestroy recommends immediate action to mitigate potential exposure. Users should avoid interacting with rhoneswiss.online or any communications referencing Swiss banking services originating from this domain. Organizations are advised to update blocklists with the domain, IP address (198.251.84.200), and registrar details to prevent access. Additionally, users should report any encounters with this domain to their IT security teams or relevant cybercrime reporting platforms. Proactive monitoring of network traffic for connections to this IP is strongly encouraged to prevent credential theft or further exploitation.