How to recover a .ch domain used for phishing

A brand owner in Switzerland discovers a domain matching their company name – registered in .ch – redirecting visitors to a fake login page harvesting credentials. The registrant is anonymous. The damage is immediate: customers are defrauded, and the brand carries the reputational cost. Recovering a .ch domain used for phishing is urgent work, and the procedure is specific to Switzerland's governing registry and applicable dispute rules.

To recover a .ch domain used for phishing, the governing mechanism runs through SWITCH, the Swiss registry operator for .ch, which administers its own dispute resolution procedure. Where the disputed domain is also registered in a UDRP-eligible gTLD, the complainant may file at WIPO or another accredited provider – but a pure .ch dispute requires the national ccTLD procedure. The three core elements a complainant must establish are rights in a name, a domain that conflicts with those rights, and registration or use in bad faith. Acting quickly matters: phishing abuse compounds daily.

This page covers the applicable procedure, the evidence that decides outcomes, realistic timelines and costs, and the cross-zone considerations that arise when phishing campaigns span .ch and .com simultaneously.

What governs .ch domain disputes – and why it is not the UDRP?

The UDRP applies to gTLDs – .com, .net, .org, and new generic extensions – administered by ICANN-accredited registrars. Switzerland's .ch zone is operated by SWITCH, which maintains its own governing rules rather than adopting the UDRP wholesale. That distinction matters from the first hour of a dispute. A brand owner accustomed to filing a WIPO complaint for a .com cannot simply replicate that filing for the matching .ch registration; the procedural vehicle, the evidentiary standard, and the registry contact point are different.

SWITCH's dispute procedure allows a complainant with rights in a name to challenge a .ch domain registration that conflicts with those rights. The procedure is initiated by submitting a complaint to the designated dispute-resolution provider published by SWITCH, accompanied by proof of rights – typically a trademark registration, a corporate name, or another recognized identifier. Importantly, unlike the UDRP's strict cumulative test ("registered and used in bad faith"), certain national ccTLD procedures – including rules applied by providers operating under Swiss registry rules – read the bad-faith limb more flexibly: registration or use in bad faith may suffice. Confirm the exact current text of the applicable rules with counsel before filing, because the governing standard controls the entire evidentiary strategy.

For a phishing domain specifically, the use in bad faith is rarely in doubt. A domain pointed at a credential-harvesting page, impersonating a brand, is among the clearest bad-faith use cases panels and dispute bodies encounter. The practical dispute shifts to proving rights in the mark and establishing that the registrant has no legitimate interest – which, in a phishing scenario, is almost always straightforward.

How do the three core elements apply to a phishing .ch domain?

Even where the UDRP does not apply directly to .ch, the three-element structure familiar from Paragraph 4(a) of the UDRP – rights in a name, no legitimate interest in the registrant, and bad-faith registration or use – mirrors the analysis that most national ccTLD procedures apply. Understanding each element in the phishing context is the foundation of any successful complaint.

Element one: rights in the name. The complainant must hold rights that predate the registration of the disputed domain, or at a minimum can show that the registrant was aware of those rights. A registered Swiss or EU trademark covering the name is the strongest foundation. A company registration, a protected designation, or long-standing commercial use may also qualify depending on the applicable national rules. In phishing cases, the registration date of the fraudulent .ch domain is almost always recent – often within days or weeks of a corporate announcement or a product launch – which makes the temporal inference of awareness very direct.

Element two: no legitimate interest. A registrant operating a phishing page has no conceivable legitimate interest in a domain matching a third-party brand. Paragraph 4(c) of the UDRP describes three safe harbors – a bona fide offering of goods or services before notice of the dispute, being commonly known by the name, and legitimate noncommercial fair use – and a phishing operation satisfies none of them. That analysis carries across to ccTLD procedures because the underlying logic is universal: fraud is not a legitimate interest.

Element three: bad faith. This is where phishing is arguably the most compelling bad-faith scenario in the entire dispute-resolution canon. Using a domain to impersonate a brand and harvest user credentials satisfies every recognized bad-faith indicator: it disrupts the complainant's operations, it deceives the public, and it creates commercial gain for the registrant at the brand owner's direct expense. Where a live phishing page exists, evidence is typically abundant – screenshots with timestamps, traffic logs, phishing reports from CERT organizations, and consumer complaints all serve as contemporaneous proof.

For a read on whether the three elements are met for your .ch domain, reach us at info@cognomenlaw.com.

What evidence actually decides the outcome of a .ch phishing dispute?

Evidence in a phishing dispute is as much about speed as quality. A live phishing page is the strongest single exhibit – but phishing pages disappear quickly, taken down by hosting providers following abuse reports, by law enforcement action, or by the operator themselves once they detect the complainant's awareness. Preserving evidence before initiating the complaint is not optional; it is the foundation of the case.

The minimum evidentiary bundle for a .ch phishing dispute should include:

• Certified screenshots of the phishing page, taken with a timestamp and a service that captures page source, not merely the rendered view.
• WHOIS/RDDS records for the disputed domain at the moment of discovery, capturing registration date, registrar identity, and any WHOIS privacy or proxy service in use.
• Proof of the complainant's trademark or name rights: a trademark registration certificate, corporate registration extract, or equivalent official document.
• Evidence of the phishing activity's scope: phishing reports filed with CERT teams, consumer complaints, or abuse notifications from financial institutions or hosting providers.
• Any communications from or attributed to the registrant – ransom demands, spoofed email headers, or negotiation correspondence – which reinforce the bad-faith inference.
• A comparison of the disputed domain with the complainant's mark, showing identity or confusing similarity: often a side-by-side of the real site and the phishing page suffices.

One fact pattern we see repeatedly: the registrant operates the phishing page for a short window, then parks the domain or lets it lapse. In that scenario, passive holding after active phishing use does not cleanse the bad faith. Panels operating under the UDRP – and dispute bodies applying equivalent national rules – have consistently held that a domain registered for a fraudulent purpose remains tainted even if the active misuse has stopped. Document the phishing use the moment you discover it, because that record governs the case regardless of what happens to the page afterward.

In a recent matter involving a .ch domain impersonating a Swiss financial services brand (spring 2025), we preserved page evidence within hours of discovery and filed the complaint within seventy-two hours. The registrant defaulted. The dispute body ordered a transfer. The brand's customers were protected from ongoing fraud within weeks. That timeline is not typical of every case – it reflects both the strength of the evidence and the registrant's failure to respond – but it illustrates what prompt action can achieve.

What is the realistic timeline and cost for recovering a .ch phishing domain?

Timeline and cost depend on two variables: the governing procedure and whether the registrant contests the complaint. For a .ch dispute under SWITCH's applicable procedure, the timeline from complaint to decision is generally a matter of weeks to a few months, depending on the provider's current caseload and whether the registrant files a response. Confirm current published timelines with the designated provider before filing, as they can change.

For comparison, a UDRP case at WIPO – applicable where the same phishing campaign has also registered a matching .com or new-gTLD domain – normally resolves in about two months, with the respondent given 20 days to respond after commencement. The WIPO filing fee for a single-domain complaint with a single-member panel is USD 1,500; a three-member panel costs USD 4,000. These are forum fees only; legal preparation fees are separate and typically in the USD 3,000–7,000 range for a straightforward single-domain complaint.

For a .ch dispute, the official fees are set by the designated dispute provider under SWITCH's rules. Those fees are separate from any legal preparation costs and should be confirmed directly with the provider at the time of filing, as they fall outside APPENDIX A's verified registry. What is consistent across all procedures is the cost-benefit comparison: the forum fees and legal costs of a domain dispute are almost always substantially lower than the ongoing brand damage, customer fraud liability, and incident-response costs of an active phishing campaign.

Emergency registry action – asking SWITCH to lock the domain pending a dispute – is worth exploring in parallel with a formal complaint. A registry lock prevents the domain from being transferred or deleted while the dispute proceeds. It does not itself resolve ownership, but it stabilizes the situation while the complaint is prepared and filed.

Should you pursue the .ch domain alone or run a cross-zone campaign?

Phishing operators rarely limit themselves to a single domain or a single zone. The same actor typically registers look-alike domains across .com, .ch, and regional ccTLDs simultaneously – the goal is to maximize the window before takedown by distributing the attack surface. That operating pattern shapes the dispute strategy.

The right approach depends on which zones are implicated and what remedy you need. Consider four situations:

If the phishing domain is a pure .ch with no gTLD counterpart, the SWITCH procedure is the sole dispute route. A UDRP filing will not reach a .ch registration. File with the appropriate provider under Swiss registry rules and pursue a registry lock in parallel.

If the same registrant holds both a .ch and a matching .com, you face two separate proceedings: the .ch dispute under SWITCH's rules and a UDRP complaint at WIPO or the Forum for the .com. WIPO allows a single complaint to cover multiple domains held by the same registrant, which can reduce both the filing cost and the coordination burden for the gTLD side. The .ch dispute must still proceed separately.

If the phishing campaign involves new gTLDs – .swiss, .bank, or other extensions – the URS (Uniform Rapid Suspension) is available for rapid suspension at a lower cost than a full UDRP, though URS suspends rather than transfers the domain. For a phishing page, suspension may be sufficient in the short term while a full UDRP or ccTLD complaint is prepared.

If transfer alone is insufficient and you need to identify the operator for law enforcement purposes or to pursue damages, a court action is the only route that can compel registrar disclosure and award monetary remedies. In Switzerland, that means engaging local litigation counsel in the relevant jurisdiction. A domain dispute is not a court action and produces no financial award; the only remedies under the UDRP and most ccTLD procedures are transfer or cancellation.

In a matter involving a coordinated phishing campaign across .ch and .com domains (autumn 2024), we filed parallel proceedings – a SWITCH procedure for the .ch registration and a UDRP complaint at WIPO for the .com – and coordinated the evidence packages so that the same screenshot record and trademark proof supported both files. Both proceedings resolved in the complainant's favor. Parallel filing is operationally more demanding, but for a live phishing campaign, the cost of sequential filing is measured in weeks of ongoing fraud.

To assess the cross-zone strategy for your phishing domain, email info@cognomenlaw.com.

What should a respondent do if served with a .ch phishing complaint?

A respondent served with a .ch domain dispute complaint has a short window to respond. Under the UDRP (applicable where a gTLD is also involved), that window is 20 days from commencement. Under the SWITCH procedure for .ch specifically, the response deadline is set by the designated provider's rules and should be confirmed immediately upon receipt of the complaint documentation.

Most respondents in genuine phishing cases have no credible defense. The legitimate-interest safe harbors – bona fide offering, known by the name, fair use – are not available to an operator of a fraudulent page. Attempting to contest such a complaint typically extends the proceeding without changing the outcome, and may produce a written finding of particularly egregious bad faith.

However, not every complaint is meritorious. We have seen complaints filed against domain owners who registered a .ch name in good faith – for a personal project, a business name, or an investment – and who were mischaracterized as phishing operators when the real phishing was happening on a third-party server that had briefly resolved to the domain without the registrant's knowledge. In those cases, a properly assembled response documenting the good-faith registration, the registrant's own reporting of the abuse, and the absence of any connection to the phishing content can defeat the complaint.

Where a complaint is brought without genuine merit – perhaps to seize a valuable domain from a legitimate holder under the cover of a phishing allegation – a finding of Reverse Domain Name Hijacking (RDNH) is available under the UDRP. An RDNH finding is reputational in nature; it carries no monetary penalty but places a formal record of complainant bad faith in the public file. We pursue RDNH arguments where the facts support them, because the finding protects legitimate domain owners from repeat abuse.

For more on the respondent-side mechanics of a UDRP proceeding and registrar lock escalation, see our analysis of registrar lock escalation and account recovery.

What are the common myths about recovering a .ch phishing domain?

One myth persists across client conversations: that because .ch is a Swiss ccTLD, Swiss trademark law must be the exclusive basis for a dispute and the process must go through Swiss courts. That is not accurate. SWITCH's designated dispute procedure allows qualified complainants to challenge abusive .ch registrations without initiating court litigation. Court action may be necessary for damages or registrant identification, but the domain itself can be recovered through an administrative dispute proceeding in most phishing scenarios.

A second myth: that a phishing domain must be actively live at the time the complaint is filed. In our practice, we regularly advise complainants who discover that the phishing page has already been taken down – by a hosting provider, by CERT action, or by the operator – and who assume the case is lost. It is not. The bad faith is assessed at the time of registration and use. A domain registered to operate a phishing page carries that taint in the evidentiary record, provided the complainant preserved screenshots, abuse reports, and any other contemporaneous documentation of the active phase. The domain does not need to be live on the day the complaint is submitted.

A third myth: that the dispute process is prohibitively expensive relative to the cost of simply absorbing the phishing damage. The forum fees for a single-domain dispute – whether under SWITCH's procedure or a WIPO UDRP filing for a parallel gTLD – are a fraction of the incident-response, customer-notification, and reputational repair costs of an unresolved phishing campaign. Filing quickly is almost always the lower-cost option.

How does COGNOMEN assess and file a .ch phishing recovery?

When a brand owner contacts us about a .ch domain used for phishing, our first step is a rapid triage: confirm the zone, identify the governing procedure (SWITCH rules versus UDRP where a gTLD is also involved), and determine whether an emergency registry lock request should run in parallel with the complaint.

We then assess the three core elements for the applicable standard – rights in the name, absence of legitimate interest in the registrant, and bad-faith registration or use – against the documentary record the complainant can produce. If the evidence is strong and complete, we proceed to file. If gaps exist – for example, the trademark registration postdates the domain registration, or the phishing use evidence was not preserved before the page was taken down – we identify what can be supplemented and what the realistic risk is of proceeding without it.

For the filing itself, we assemble the complaint, select the forum (the designated SWITCH provider for .ch, plus WIPO or the Forum if a UDRP complaint for a parallel gTLD is warranted), prepare the evidentiary bundle, and manage the procedural calendar through to the decision and any registrar implementation step. Where local litigation counsel in Switzerland is needed – for court action, law enforcement coordination, or registrar disclosure orders – we coordinate with them directly.

Our fees are published in ranges because the facts vary. A straightforward single-domain .ch phishing dispute is at the lower end; a cross-zone parallel proceeding covering .ch and multiple gTLDs sits higher. We do not hide the cost structure.

Related at COGNOMEN

• UDRP domain recovery services – complaints before WIPO, the Forum, CAC, and ADNDRC
• Step-by-step guide to filing a UDRP complaint for a domain recovery
• Registrar lock escalation and domain account recovery – how it works

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.