Security proof of concept

This hostname is not operated by Swissmedic

apim-ref.swissmedic.ch

Already reported — no incident response needed

Submitted via the Swissmedic bug bounty programme on Bug Bounty Switzerland (now SignalFisher) before this page went up. If in doubt, contact your SignalFisher programme contact.

Ramin Töpfer

https://www.linkedin.com/in/ramintopfer/

Via Bug Bounty Switzerland / SignalFisher Ref Submitted via the SignalFisher platform Claimed 2026-10-25 16:44 UTC

The issue

Record: apim-ref.swissmedic.ch
CNAME to: apim-smc-platform-ref.azure-api.net
Problem: Target was deleted, the DNS record was not — leaving the name free for anyone to register.

Risk

Phishing and malware from an official Swissmedic domain
A valid, publicly trusted TLS certificate is obtainable
Live API traffic captured — tokens, keys, payloads
Cookies scoped to .swissmedic.ch can be read and set

Fix

Remove the apim-ref.swissmedic.ch CNAME record. Do this before asking for the Azure resource to be released — otherwise the name is free again. Other records are affected too; see the report.

This page

Static content only — no backend, nothing forwarded
No logging, no telemetry, no data retained
Self-signed certificate — no public CA, no CT log entry
No other Swissmedic system was touched