[OPEN] eXch Anti-Phishing Campaign

[bestcandy]

BTC address- bc1q9rd2hqm8xfcwnsfaj206j8h66rh9wxnhvlqjn5

[ovcijisir]

~

You can reply to them and remind them of their responsibilities (they must take actions and suspend domains that violate the registrar's ToS), do not hesitate to include the link mentioned above as well as this one: https://tucowsdomains.com/report-abuse/#phishing

I saw your reply to Tucows from the email correspondence on my report. As far as I know, Tucows does not sell domains directly to end users, but through partners who only use their network. I think it would be better to put pressure on the reseller partner

I also reminded them of their responsibilities, but they answered me that it is out of their jurisdiction and that they forwarded complaint to corresponding provider. I guess that they sent it to provider of domains, so Tucows really don't have power to suspend domains.

[Danydee]

Bitcoin address:  bc1qsgnfrndxj20lvz5m2f6n2xggk85pjtzahjtnda

[SamReomo]

I received a similar response from the registrar, so I forwarded it to the email address police.gov.cy.

I also received the response from Namecheap from that registrar that you guys mentioned

[Obim34]

I have just received this reply from domains@nic.cy

Your complaint below has been forwarded to the competent authorities.

Please also submit your complaint at: https://cybercrime.police.gov.cy/police/CyberCrime.nsf/subscribe_en/subscribe_en?openform,

Email: cybercrime@police.gov.cy

What does this mean? Should we report this to the authorities as well? Aren't they the web hosts?

I will report the authority email mentioned in their reply. I don't know if i have to send proof to exch support email as well or no need for that.

No need, it has been forwarded so the appropriate team will receive the complain, i received same inbox which was sealed as a confidential complain.

Five domains are still active and no real reply from abuse@namecheap.com, support@nic.cd, complains@nic.cy or domains@nic.cy whatsoever.

Namecheap Legal & Abuse Team
17 Mar 2025, 12:35 (2 days ago)
to me

Hello,

Thank you for contacting the Namecheap Legal and Abuse department. We confirm the receipt of your report, it will be reviewed and processed following our policies.

Please be aware that Namecheap investigates a large volume of complaints, therefore, we will respond to you only if additional information on the matter is required. However, rest assured that your complaint will be properly evaluated and action will be taken if necessary.

You are welcome to check yourself if the domain is active by searching the domain status via Namecheap Lookup (https://www.namecheap.com/domains/whois/). If the domain status is in clientHold/serverHold, it means the domain has been suspended and is not available on the internet.

If you wish to contact the domain holder, hosting, or email provider for the domain name in question, you may consider using the RrSG ACID Tool (https://acidtool.com/) to identify their contact details.

I got this response from them, i believe they should be working on suspending those phishing domains.

[Pmalek]

Tucows responded to my report asking for proof that exch[.]cash is a phishing site. I can show them whois records as proof when exch.cx was created compared to exch[.]cash and how the later mimics the official domain but it would be great if we also had some reports by users who got phished by exch[.]cash and lost their money. I couldn't find any. Does anyone have anything useful? @eXch Support what do you say?

[eXch Support]

Tucows responded to my report asking for proof that exch[.]cash is a phishing site. I can show them whois records as proof when exch.cx was created compared to exch[.]cash and how the later mimics the official domain but it would be great if we also had some reports by users who got phished by exch[.]cash and lost their money. I couldn't find any. Does anyone have anything useful? @eXch Support what do you say?

Indeed, the best thing to do is to give them the whois records.

Also you can communicate the link of our ANN on Bitcointalk: https://bitcointalk.org/index.php?topic=577207
There is also the ANN on Altcoinstalks: https://www.altcoinstalks.com/index.php?topic=312970.0

[Medusah]

Tucows responded to my report asking for proof that exch[.]cash is a phishing site.

The proof is that the support account of eXch in Bitcointalk says so:  https://bitcointalk.org/index.php?topic=577207.msg64999931#msg64999931.  I used this as reference in my report. 

[Cityhunter34]

Count me in! Let's report these scammers.

BTC address- bc1qnge97c2myxkqutfx48cql4ckdfyrmqwvk7ultx

Edit: below is the reply I got from namecheap legal and abuse team. I haven't gotten any reply from others yet.

[Medusah]

support@nic.cd  (use BCC, not CC)

This one keeps rejecting my emails due to... "spam".  I use them as recipient and insert "support@exch.cx" in the BCC field.  Am I not doing it right?  I use Proton. 

[xOrpian]

support@nic.cd  (use BCC, not CC)

This one keeps rejecting my emails due to... "spam".  I use them as recipient and insert "support@exch.cx" in the BCC field.  Am I not doing it right?  I use Proton.  

Protonmail is most likely filtered by this organization.

Edit: You can try resending the mail using Outlook, Gmail, or another mail service to see if the error persists.

[Cricktor]

I got this from noreply@support.networksolutions.com

Thank you for bringing this matter to our attention. Upon reviewing your complaint, we have notified our customer that they have 48 hours to remove the phishing content in accordence with our terms of service.

Kind regards,
Customer Support

-- Do not delete or change the following text --
Security code: ^^DmrGprcB1q77hvq8w2DHsQ==^^
The above code helps us secure your communication.

complains|domains@nic.cy responded both with

Your complaint below has been forwarded to the competent authorities.


Please also submit your complaint at: https://cybercrime.police.gov.cy/police/CyberCrime.nsf/subscribe_en/subscribe_en?openform,

Email: cybercrime@police.gov.cy

Which competent authorities? I assume, very much no competence at Registry .cy 


Tucows responded with the known lame excuse to refuse to take any action on their own. Thanks to exch.support for the quotes to remind them of their own words and responsibilities. I used some harsher words in my second response to Tucows.

All responses were BCCed to support@exch.cx

[igebotz]

I've reported all the remaining phishing links and BCC @exch supports too. Will post the response here.

[bchannel]

I saw this topic quite late.
I also reported all the remaining domain names. If there is any progress, send a portion of my reward to anyone who is affected by this scam domains.

[Peanutswar]

Upon reporting the

Code:

monero[.]forex

, they responded with this email.

Tucows responded to my report asking for proof that exch[.]cash is a phishing site.

The proof is that the support account of eXch in Bitcointalk says so:  https://bitcointalk.org/index.php?topic=577207.msg64999931#msg64999931.  I used this as reference in my report. 

Are there any supporting details that could be used like this so I can follow up on the email thread

[Ambatman]

Upon reporting the

Code:

monero[.]forex

, they responded with this email.

Tucows responded to my report asking for proof that exch[.]cash is a phishing site.

The proof is that the support account of eXch in Bitcointalk says so:  https://bitcointalk.org/index.php?topic=577207.msg64999931#msg64999931.  I used this as reference in my report. 

Are there any supporting details that could be used like this so I can follow up on the email thread

I wasn't responded in lacking evidence
I didn't really brand them as been a phishing site
More like promoting a phishing site.
No response from both since the last auto response
They usually Send.
That's like 4-5 days ago.

[joker404]

Reported all avaliable phising sites from OP

My BTC adress: bc1qp0pkjanrc4kjgs2vka349u9emnzldcnm5nngq2

[Pmalek]

Indeed, the best thing to do is to give them the whois records.

Also you can communicate the link of our ANN on Bitcointalk: https://bitcointalk.org/index.php?topic=577207
There is also the ANN on Altcoinstalks: https://www.altcoinstalks.com/index.php?topic=312970.0

Tucows responded with this:

We have sent the complaint to the corresponding provider and are verifying the registrants details.

Again, due to the limited technical sphere in which Tucows operates, we do not believe that we are the correct party to contact regarding this matter.  In this instance, we suggest that you contact the party operating the website or the party hosting the website to have this matter properly resolved. A "ping" of the website you indicated often reveals the IP address of the party which probably hosts this website.  A "ping" of the website you indicated often reveals the IP address of the party which probably hosts this website. You may then use https://hostingchecker.com, https://search.arin.net/ or another similar tool to identify this party.

In other words, they don't want anything to do with this and are pushing us to ask that actions are taken against the phishing domain elsewhere.

[xOrpian]

In other words, they don't want anything to do with this and are pushing us to ask that actions are taken against the phishing domain elsewhere.

They made it clear 'They don't have authority.', They provided me with instructions - After I found the host of the domain, which was 'IP Volume Inc.'
I reported the domain, I was followed by an email from 'Tucows' they've also sent a report to 'IP Volume Inc.' to assist with the case.

IP Volume Inc
Abuse Policy:
IP Volume and its affiliates respect the Law and reserve the right to disable access to any IP address with immediate effect if it does not comply with its policies:

We do not allow any form of:
- Bulletproof Hosting
- Childporn/CSAM content (see https://childporn.report)
- Ddos attacks
- Brute force attacks
- Malware / Ransomware / Spyware (We use Shadowserver reports)
- Spam (We fight against spam with spamhaus.net)
- Phishing

This should be the correct place to report.

[Pmalek]

@eXch Support
Do you agree with xOrpian's findings from above, and is IP Volume Inc the right party to send complaints about exch[.]cash?