Warning: Exch.cc phishing scam replicating Exch.cx near perfectly.

[BenCodie]

This is a very clever scam, seeing as though I have accidentally typed exch.cc instead of exch.cx multiple times in the past however the .cc domain has always been invalid.

It seems that someone has created a near exact replica of the legitimate exch.cx website on the domain exch.cc and is capitalizing on typos. I assume this is because .cx is a much less known domain extension in comparison to .cc.  I am (hopefully and very embarrassingly) their first victim. Being a privacy and cybersecurity advocate, I hope that the slight shame that comes with this post is outweighed by preventing misfortune for others.

What happened:: Went to exch.cc instead of exch.cx, proceeded to create a trade as per normal, realized that I was phished after the transaction confirmed though nothing progressed.

Scammers Profile Link: No profile. website: https://exch.cc

Reference Link: https://exch.cc
Amount Scammed: Roughly 60 USD
Additional Notes: There is no order ID after creating an order on https://exch.cc and the letter of guarantee is not a valid signature. Of course, I overlooked these initially (thinking I was using the expected service) and checked them after I had realized the mistake.

I hope that no one makes the same mistake.

Legitimate: https://exch.cx
Scam/Phishing: https://exch.cc

[Charles-Tim]

The fake domain sound very familiar I think from this same scammer: https://ninjastic.space/topic/5527899

You can see a scammer mentioned the domain on that link that has been deleted on this forum saying no belonging to them anymore. But it is an easy catch. I think I reported it in the past but I am unable to see the report.

These are the legit exch links:
https://exch.cx/
https://exch.pw/
https://hszyoqwrcp7cxlxnqmovp6vjvmnwj33g4wviuxqzq47emieaxjaperyd.onion/

Others are fake.

If you scroll down on the exchange, you can see all the legit links there.

[paid2]

Unfortunately you're not the first one being scammed by ".cc" .. This phishing copy has been mentioned a few times inside eXch ANN recently and at least one other forum user reported he lost funds on it...

If this domain is not yours : exch dot CC - [SCAM link]
Then im just lost my funds right now  Rest in peace 0.027 btc

Oh, I just noticed you're talking about exch.cc That domain is not owned by the official eXch service, so it can be considered a phishing site.
The official domains are exch.cx and exch.pw

There was a discussion about it recently and here is confirmation

exch[.]cc is a phishing link and does not belong to eXch anymore, don't be scammed by using it! (By the way can you please edit the links in your message?)

I (as some others regulars of this thread I think) have reported it to the registrar a few times, but they never answered for now..

OP, you should modify the links in your post perhaps.. I mean like rollinsweet did with replacing the “.” with “DOT” or something, so the forum doesn't offer them any free SEO.

[hosemary]

This is a very clever scam, seeing as though I have accidentally typed exch.cc instead of exch.cx multiple times in the past however the .cc domain has always been invalid.

The cc domain which is now owned by scammers was the real domain of eXch in the past.
eXch moved from the cc domain to cx domain and the cc domain became unavailable until scammers took control of that in December of last year.

[BenCodie]

This is a very clever scam, seeing as though I have accidentally typed exch.cc instead of exch.cx multiple times in the past however the .cc domain has always been invalid.

The cc domain which is now owned by scammers was the real domain of eXch in the past.
eXch moved from the cc domain to cx domain and the cc domain became unavailable until scammers took control of that in December of last year.

That might be why I keep on mistaking cc for cx. I'm sure eXch is making enough to keep a domain renewed. It is a shame they did not at least keep it to prevent something like this from happening.

Unfortunately you're not the first one being scammed by ".cc" .. This phishing copy has been mentioned a few times inside eXch ANN recently and at least one other forum user reported he lost funds on it...

If this domain is not yours : exch dot CC - [SCAM link]
Then im just lost my funds right now  Rest in peace 0.027 btc

Oh, I just noticed you're talking about exch.cc That domain is not owned by the official eXch service, so it can be considered a phishing site.
The official domains are exch.cx and exch.pw

There was a discussion about it recently and here is confirmation

exch[.]cc is a phishing link and does not belong to eXch anymore, don't be scammed by using it! (By the way can you please edit the links in your message?)

I (as some others regulars of this thread I think) have reported it to the registrar a few times, but they never answered for now..

OP, you should modify the links in your post perhaps.. I mean like rollinsweet did with replacing the “.” with “DOT” or something, so the forum doesn't offer them any free SEO.

I see. Not good.

I will keep the domain as it is, as I think people will search the domain and this thread should rank close to (if not higher than) the scam domain itself.

The fake domain sound very familiar I think from this same scammer: https://ninjastic.space/topic/5527899

You can see a scammer mentioned the domain on that link that has been deleted on this forum saying no belonging to them anymore. But it is an easy catch. I think I reported it in the past but I am unable to see the report.

These are the legit exch links:
https://exch.cx/
https://exch.pw/
https://hszyoqwrcp7cxlxnqmovp6vjvmnwj33g4wviuxqzq47emieaxjaperyd.onion/

Others are fake.

If you scroll down on the exchange, you can see all the legit links there.

That is for exch.cat. Though yes it may be a possibility it is the same persons.

Exch.cc is also with cloudflare. I'm not sure if cloudflare do much about this kind of thing though I'll be sure to report to them.

[albon]

That is for exch.cat. Though yes it may be a possibility it is the same persons.

Exch.cc is also with cloudflare. I'm not sure if cloudflare do much about this kind of thing though I'll be sure to report to them.

Scammers are quick to impersonate popular brand names to deceive users of these trending brands. Therefore, users should be cautious and bookmarking legitimate domains is also a good idea. This is because the interfaces of these fraudulent domains are very similar to the official ones.

Scammers have impersonated Exch through several domains, which have now been taken down. All we have to do is report the domain registrar and Cloudflare. When they find repeated complaints, they will immediately shut down the domains as they will recognize policy violations.

As for me, I have already submitted reports for both domains and am awaiting their review.



Thank you all for making the crypto community safer.

[BenCodie]

That is for exch.cat. Though yes it may be a possibility it is the same persons.

Exch.cc is also with cloudflare. I'm not sure if cloudflare do much about this kind of thing though I'll be sure to report to them.

Scammers are quick to impersonate popular brand names to deceive users of these trending brands. Therefore, users should be cautious and bookmarking legitimate domains is also a good idea. This is because the interfaces of these fraudulent domains are very similar to the official ones.

Scammers have impersonated Exch through several domains, which have now been taken down. All we have to do is report the domain registrar and Cloudflare. When they find repeated complaints, they will immediately shut down the domains as they will recognize policy violations.

As for me, I have already submitted reports for both domains and am awaiting their review.



Thank you all for making the crypto community safer.

It's a shame that these kinds of people exist...and even more of a shame that silly mistakes like mine motivate them to continue.

This whole situation gives me the idea of a phishing detector add-on/extension...Something that should be made standard to alert you that you're not on the right site in situations like this. I am not even vulnerable generally, so I think it would be quite useful for the average user.

I just searched for phishing detectors on the firefox add-on store, this is untapped based on searching Phishing Detector on the Firefox store. A search also reveals add-ons barely used with no reviews.

Maybe that is the silver lining from this situation? Anyone know how to build a basic add-on that indexes official sites (maybe on github or something where the public can contribute) that can be open sourced and added to the firefox store? You might be solving a huge problem by doing so.

[paid2]

Maybe that is the silver lining from this situation? Anyone know how to build a basic add-on that indexes official sites (maybe on github or something where the public can contribute) that can be open sourced and added to the firefox store? You might be solving a huge problem by doing so.

OrangeFren created an open source add-on like this a few weeks ago, but as far as I know, for now it's only available for Chromium based browsers actually... He told me that he's open to build a Firefox version, hopefully we will have it available soon.

Today we're launching the OrangeFren Plugin!

It's an extension for Chromium-based browsers that exists to safe-guard users from accessing phishing scams aimed against the users of exchanges listed on OrangeFren.com

It downloads a list of known phishing domains from OrangeFren.com once an hour, as well as self-generates possible phishing domains and compares the websites you access against them. The extension is open-source and it does not save or transmit any of your activity.

You can get it here: https://github.com/orangefren/OrangeFren-Plugin/releases/tag/v0.2

[hugeblack]

Before depositing, download letter_of_guarante and then verify the signature to ensure you are depositing to an eXch address. I wonder why eXch doesn't add it to the Q&A to avoid phishing links or at least help reduce them.

[BenCodie]

Before depositing, download letter_of_guarante and then verify the signature to ensure you are depositing to an eXch address. I wonder why eXch doesn't add it to the Q&A to avoid phishing links or at least help reduce them.

When I use exch, I am basically a macro. I don't really think, I just do. This is what was clever about the scam. There were really no irregularities with the fake exch and the real one. By the time I realized something was up, my transaction was already confirmed and it was too late. If there were irregularities or I noticed the different domain before I sent, I would have checked the letter of guarantee. This in fact, was how I verified they were a scam (of course, exch cc had a fake signature).

Unfortunately in my case, I don't think anything could have prevented the loss. I was on semi autopilot, and I mistook the domain, the rest is history.

Maybe that is the silver lining from this situation? Anyone know how to build a basic add-on that indexes official sites (maybe on github or something where the public can contribute) that can be open sourced and added to the firefox store? You might be solving a huge problem by doing so.

OrangeFren created an open source add-on like this a few weeks ago, but as far as I know, for now it's only available for Chromium based browsers actually... He told me that he's open to build a Firefox version, hopefully we will have it available soon.

Today we're launching the OrangeFren Plugin!

It's an extension for Chromium-based browsers that exists to safe-guard users from accessing phishing scams aimed against the users of exchanges listed on OrangeFren.com

It downloads a list of known phishing domains from OrangeFren.com once an hour, as well as self-generates possible phishing domains and compares the websites you access against them. The extension is open-source and it does not save or transmit any of your activity.

You can get it here: https://github.com/orangefren/OrangeFren-Plugin/releases/tag/v0.2

This is great and I will be supporting this! Thank you for sharing.

[robelneo]

Exch.cx just launched an anti Phishing campaign

Anti-Phishing Campaign

This is such an excellent move by Exch.cx, a campaign to stop the proliferation of phishing on their platform.
Many users will be victimized, which will result in losing revenues for their platform. I think this is the first kind of campaign, and hopefully other platforms will follow Exch.cx Initiative.

[paid2]

Exch dot cc just launched an anti Phishing campaign

eXch Anti-Phishing Campaign

This is such an excellent move by Exch dot cc, a campaign to stop the proliferation of phishing on their platform.
Many users will be victimized, which will result in losing revenues for their platform. I think this is the first kind of campaign, and hopefully other platforms will follow Exch dot cc Initiative.

Man.. It's nice to share the anti-phishing campaign, but you should not spread this phishing link ("exch dot cc") like this... The legit domain of eXch is exch.CX

[robelneo]

Exch dot cc just launched an anti Phishing campaign

eXch Anti-Phishing Campaign

This is such an excellent move by Exch dot cc, a campaign to stop the proliferation of phishing on their platform.
Many users will be victimized, which will result in losing revenues for their platform. I think this is the first kind of campaign, and hopefully other platforms will follow Exch dot cc Initiative.

Man... It's nice to share the anti-phishing campaign, but you should not spread this phishing link ("exch dot cc") like this... The legit domain of eXch is exch.CX

Apology for overlooking this  , my bad, brother. I have corrected the errors; everything is good now

[BenCodie]

Exch.cx just launched an anti Phishing campaign

Anti-Phishing Campaign

This is such an excellent move by Exch.cx, a campaign to stop the proliferation of phishing on their platform.
Many users will be victimized, which will result in losing revenues for their platform. I think this is the first kind of campaign, and hopefully other platforms will follow Exch.cx Initiative.

Thank you for sharing, good to see that they are taking action and gave a list of more places to report, went ahead and did so Hopefully the phishers get taken down.

[coin-investor]

...good to see that they are taking action and gave a list of more places to report, went ahead and did so Hopefully the phishers get taken down.

If those phishing links are hosted on domain name registrars that are compliant with ICANN like Namecheap, they will be easily taken down; they are against developers who are using their platform to set up phishing platforms.
This is one of the best ways to fight phishing sites by doing a reporting campaign.
Domains are cheap, and creating phishing sites are profitable for hackers. With the success of the campaign there will be more following the leads of Exch.cx


 

[shasan]

Sorry for your loss and thank God that it is not ha higher amount if it could be a higher amount then all money would be forfeited. You are a talented person but I could not understand how you used a phishing site and deposited your real money to a site that is phishing and as you have previously used the real site you could Identify that the site is fishing If you could double check.                                                                                                                                                                                                                                                                                                                                                                                                                                                                       

[BenCodie]

Sorry for your loss and thank God that it is not ha higher amount if it could be a higher amount then all money would be forfeited. You are a talented person but I could not understand how you used a phishing site and deposited your real money to a site that is phishing and as you have previously used the real site you could Identify that the site is fishing If you could double check.                                                                                                                                                           

I was surprised myself and face palmed after I had noticed. I had entered .cc instead of .cx by mistake in the past (probably because it was their old domain), though the domain never connected this time and I followed the process without vigilance. It was a rusty and lazy moment on my behalf. It could have been a lot worse!

...good to see that they are taking action and gave a list of more places to report, went ahead and did so Hopefully the phishers get taken down.

If those phishing links are hosted on domain name registrars that are compliant with ICANN like Namecheap, they will be easily taken down; they are against developers who are using their platform to set up phishing platforms.
This is one of the best ways to fight phishing sites by doing a reporting campaign.
Domains are cheap, and creating phishing sites are profitable for hackers. With the success of the campaign there will be more following the leads of Exch.cx

The campaign that the official exch support team have started seems to be successful so far, and lots of tickets have been made with namecheap to take down some of the other domains. Thankfully, the .cc domain has already been suspended.