switchnet[.]ch

switchnet.ch is currently active and has been classified as a high‑risk Google brand‑impersonation campaign. The site returns HTTP 200 with the page title “One moment, please…”, indicating an attempt to hold the visitor while further actions are prepared. The domain was created on 28 February 2026 and is hosted in Switzerland under ASN 35206 (NovaTrend Services GmbH). The domain was registered through Novatrend.ch and resolves to IP 193.33.128.139. DNS resolution uses the top‑host nameservers ns9.tophost.ch and ns10.tophost.ch. The server presents a Let’s Encrypt R12 certificate and runs Nginx with the OpenResty module, a stack commonly observed in malicious hosting environments. Reputation data shows significant concern: VirusTotal records 7 out of 95 scanners flagging the domain, Scamadviser assigns a trust score of 1 / 100, Gridinsoft reports 0 / 100, and the domain appears on at least one public blocklist. The MX records point to mx01.tophost.ch and mx02.tophost.ch, and the site is listed as a tech‑support scam in the intelligence feed. Publicly available information does not include a detailed content analysis beyond the generic page title, nor any observed credential‑capture elements. Consequently, the exact phishing workflow, payload delivery method, or victim interaction steps remain unknown. Continued monitoring of the URL and associated infrastructure is required to capture any evolving tactics. Defenders should immediately block switchnet.ch and its resolve IP 193.33.128.139 at network perimeter and DNS filtering layers. Email gateways should be configured to reject messages originating from the listed MX hosts. Security teams should add the domain and IP to threat‑intel feeds and monitor for any related sub‑domains or similar certificate usages. Users should be warned about unsolicited Google‑related support calls that reference this domain.