Attack on .ch and .li domains

May 6 19:42 [raw]

Attack on .ch and .li domains A nice story happened few days ago: Switchplus, the biggest registrar of .ch and .li domains have blocked the archive mirror domain “”. The reason was “we have informed by the police that there is ‘illegal content’ hosting on the domain”. They also treatened to delete the domain after 3 days of blocking. After short interview[1] it was discovered that the “police report” has been sent not by the police but by a random person who simple wrote “detective sergeant” at the bottom of his email. And what made the Switchplus executive believe that the email was really send by the police is that it was a “repetitive case”. How nice. When Switchplus receives few emails signed by Nigerian King, it would ensure them they are talking to real Nigerian King. A rowhammer attack, huh. I was under impression of talking to an inexperienced junior employee, but quick googling revealed that Wolfram Schmidt is the CEO of Switchplus, about 50 years old[2]. He manages assets of thousands people and feels right to sequestrate them based on fake email messages in his inbox. If you - my reader - have a business competitor with a website on .ch or .li domain, you might easily destroy the business of the competitor by sending email message to Wolfram Schmidt telling that you are a Nigerian Detective and you found something illegal on the competitor’s website. You do not even have to point what exactly is illegal. One message might be not enough but 2-3 messages should form a “repetitive case”. And if you own a .ch or .li domain managed by Switchplus, your domain is in danger. 1. 2.

[chan] 411