[OPEN] eXch Anti-Phishing Campaign

[albon]

Tucows points us all to their partner where the exch [.] cash domain is registered, but they can't confirm which partner it is. At the very end of the report from the whois database, there is information that it is easyDNS Technologies Inc
I just reported this domain to them, so I invite others to do the same.
email address is: abuse@easydns.com

I previously sent a report to Tucows and received the following response from them:

"Hello, Thank you. We will investigate."

I have also submitted a report to EasyDNS regarding the domain exch[.]cash. When I try to open the domain link, the following message appears:

"So Don't Do That Then... (This domain has been terminated for abuse)"

As shown in the following screenshot:

[xOrpian]

Tucows points us all to their partner where the exch [.] cash domain is registered, but they can't confirm which partner it is. At the very end of the report from the whois database, there is information that it is easyDNS Technologies Inc
I just reported this domain to them, so I invite others to do the same.
email address is: abuse@easydns.com

I previously sent a report to Tucows and received the following response from them:

"Hello, Thank you. We will investigate."

I have also submitted a report to EasyDNS regarding the domain exch[.]cash. When I try to open the domain link, the following message appears:

"So Don't Do That Then... (This domain has been terminated for abuse)"

As shown in the following screenshot:

I got the identical mail. The mail I received was from Tucrows, not from easyDNS, and I haven't sent any mail to easyDNS until now.

The emails I received contained two messages: 'One is them investigating, the other is them doing their due diligence on the domain name.'
Seems like ICANN's involvement isn't required anymore.

[Haunebu]

We did it again team. Exch.cash is down. Tucows probably didn't do shit about it and I think their reseller which is easydns that I mentioned in one of my earlier posts took them down. Just a couple more remaining.

[xOrpian]

We did it again team. Exch.cash is down. Tucows probably didn't do shit about it and I think their reseller which is easydns that I mentioned in one of my earlier posts took them down. Just a couple more remaining.

Yes it's possible easydns could've taken it down.

I've just received an email from Tucows, they mentioned 'this was a result of Tucows' investigation!'

[Kavelj22]

I still receive emails from the services i made reports to. I see users here sharing those emails here. Is this a part of report verification steps instead of including exch to cc or bcc in each email report we send?

I am a bit confused. Just try to stay updated as i didn't visit the forum since few days.

Cheers,

[Haunebu]

Found out through my research that nic.cd is the registry(Not registrar) who aren't replying at all to any of our reports. Noticed that SCPT is the registrar for exch.cd which is why we should try submitting abuse reports to them to take it down.

Link: https://services.hosting.cd/services/submitticket.php?step=2&deptid=1

I've just received an email from Tucows, they mentioned 'this was a result of Tucows' investigation!'

That's surprising. Says easydns fraud in the whois tool. Anyway, cool either way.

I still receive emails from the services i made reports to. I see users here sharing those emails here. Is this a part of report verification steps instead of including exch to cc or bcc in each email report we send?

Nah. It isn't necessary. Including support@exch.cx in bcc is enough.

[xOrpian]

I've just received an email from Tucows, they mentioned 'this was a result of Tucows' investigation!'

That's surprising. Says easydns fraud in the whois tool. Anyway, cool either way.

Whois record [25/03/2025] update

Reseller: easyDNS Technologies Inc.
Name Server: fraud.easydns.wtf
Name Server: terminated.easydns.wtf

easyDNS is a reseller and registration service provider. Tucows had more authority over the domain.

4 more are left.

[d5000]

I can confirm exch.cash is down too. Congrats to everybody!

Link: https://services.hosting.cd/services/submitticket.php?step=2&deptid=1

Opened a ticket there too. Let's see if/what they answer.

[examplens]

"So Don't Do That Then... (This domain has been terminated for abuse)"

As shown in the following screenshot:

Well, this is good news. It's good to know that at least easyDNS responded.

Tucows does not seem to have accurate insight into which domain is registered with which of their partners. The last answer I received from them was to direct me to the partner responsible for the disputed .cash domain

Code:

you can find provider contact information in the public whois or via https://tucowsdomains.com/provider-search/

This information was obtained from a different whois server, so we cannot verify its authenticity.

Registration Service Provider:
easyDNS Technologies Inc., easydns@myprivacy.ca

Another positive effect of the suspension of the exch[.]cash domain is that it now eliminates the purpose of the additional two domains monero[.]forex and darknetbible[.]info, which served to promote the phishing site. It's useless now.


eXch Support, you can mark this domain as solved (for now); there is no need to spam the registrars.

[SamReomo]

Great effort by all members who are taking this campaign seriously. We have already destroyed some of those phishing domains and hope soon the rest of the domains will also go down.  Reported that .CD one once again.

[Cricktor]

Opened a ticket at https://services.hosting.cd/services/submitticket.php?step=2&deptid=1, name used is of course fake.

Did anybody get a confirmation for the ticket or a ticket no. so far?



@eXch Support
It doesn't help me to provide you proof of reporting when my email address is rejected by your spam filter. 
Did I something wrong? Why are my reporting copies (usually you're in BCC) rejected by your spam filter. I would appreciate if you could whitelist my email address (see below from my screenshot):

[Text]

I’m joining the eXch Anti-Phishing Campaign!

My BTC address: bc1q5paqsvql3t65fqj3szfqalm2r4ud38kjhny5kdhkw6u4d0kwrkrs97943j

I’ve sent abuse reports for the following phishing domains:

• monero[.]forex
• darknetbible[.]info
• exch[.]cd
• exch[.]cy

Looking forward to helping make the community safer. Let’s shut these scammers down!

[Medusah]

https://centralnic.support/hc/en-gb/requests/new

Choose legal -> Abuse -> Takedown request in the form.

Could you share how you reached to the conclusion that centralnic.com is behind nic.cd?  I did report using that form, but I just want to know, because I could not find anything related. 

Opened a ticket at https://services.hosting.cd/services/submitticket.php?step=2&deptid=1, name used is of course fake.

Why do you report to a web hosting service?  Is it related with the company "nic.cd", or do you suspect they sell web hosting services to exch[.]cd?  I'm asking, because eXch Support wrote this:

Update: We have noticed some users sent abuse report to the hosting company. Please DO NOT send abuse requests to hosting companies.

[xOrpian]

Why do you report to a web hosting service?  Is it related with the company "nic.cd", or do you suspect they sell web hosting services to exch[.]cd?  I'm asking, because eXch Support wrote this:

Update: We have noticed some users sent abuse report to the hosting company. Please DO NOT send abuse requests to hosting companies.

eXch support made it explicitly clear that it has to be reported to the Registrar.

If you report to the host and they take down the server, 'Considering takedown request was approved,' the person/people behind the phishing domain can choose another host for the same domain and continue their work, all they have to do is copy the files to the server of another host. (Suspending the domain should be a priority, not the server of the host.)

[Haunebu]

Could you share how you reached to the conclusion that centralnic.com is behind nic.cd?  I did report using that form, but I just want to know, because I could not find anything related. 

Just checked again and it looks like Google AI confused me due to which I made a mistake here. They aren't related and you are right.

Why do you report to a web hosting service?  Is it related with the company "nic.cd", or do you suspect they sell web hosting services to exch[.]cd? 

You are wrong here. SCPT is the registrar.

eXch support made it explicitly clear that it has to be reported to the Registrar.

If you report to the host and they take down the server, 'Considering takedown request was approved,' the person/people behind the phishing domain can choose another host for the same domain and continue their work, all they have to do is copy the files to the server of another host. (Suspending the domain should be a priority, not the server of the host.)

SCPT is the registrar. Check properly.

https://www.eurodns.com/whois-search/cd-domain-name

Also, hosting providers do effectively take down scam domains sometimes. Your logic about them choosing a new host to continue their dirty work is accurate, but they could just as well choose a new registrar, hosting provider with that backup. Think!

[xOrpian]

SCPT is the registrar. Check properly.

https://www.eurodns.com/whois-search/cd-domain-name

Also, hosting providers do effectively take down scam domains sometimes. Your logic about them choosing a new host to continue their dirty work is accurate, but they could just as well choose a new registrar, hosting provider with that backup. Think!

My reply was not for 'SCPT', but specifically for hosts.

I don't know about hosting providers having the right to suspend a domain with the same losses as the domain owner. AFAIK, the host can disable access to the domain to the account it's associated with.
When it comes to registrars suspending a domain, it leads to permanent suspension, and without appeal, you have no chance of getting the domain back. (But after hosting a phishing website on the domain, would you dare make the appeal? - Also, if you're professionally phishing like we're seeing here for exch, then you won't even use your own documents to register the domain in the first place.

There's a reason Exch support made it specific to report to registrars, and not hosts.

Can the phishing use other domains and hosts (Yes)? But would it have the same popularity as the ones that are already live (I think not)? In time, another domain might become popular, that's phishing exch, but the previous ones whose domains have been permanently suspended (by registrars), not hosts. In other words, links of these suspended domains will cease to function (Popularity is an overstatement here, there are other means a domain can become popular, not just in SE, or Articles on websites phisher controls, too).

This can be another reason I can think exch support making this statement when adding new domains to this thread.

It is obvious that our team will analyze the domains that are reported to us, so creating new ones in order to abuse the rewards will not be possible. We only consider to add new domains when they're older than 6 months.

They know what they are doing, including having thought through the potential ways this bounty can be abused.

[eXch Support]

@eXch Support
It doesn't help me to provide you proof of reporting when my email address is rejected by your spam filter. 
Did I something wrong? Why are my reporting copies (usually you're in BCC) rejected by your spam filter. I would appreciate if you could whitelist my email address (see below from my screenshot):

Hello Cricktor

It seems the spam filter in question is Proton Mail's itself, not ours. Proton Mail sometimes rejects outgoing emails for suspecting it might be a spam that their user sends.

We'll contact you privately in due time (before the rewards are distributed).

[apogio]

Hello Cricktor

It seems the spam filter in question is Proton Mail's itself, not ours. Proton Mail sometimes rejects outgoing emails for suspecting it might be a spam that their user sends.

We'll contact you privately in due time (before the rewards are distributed).

Hello @eXch Support please note that I had the same issue that Cricktor had.

Some emails didn’t go through.

Here is a sample screenshot of the issue:

[NotATether]

Hello @eXch Support please note that I had the same issue that Cricktor had.

Some emails didn’t go through.

Here is a sample screenshot of the issue:

That's Proton Mail blocking your message from being sent. Have you used this email for anything else before? They really don't like it when you only send outgoing messages. Especially if you are a free account.

[Pmalek]

@eXch Support
Ay updates on what else we could do for the remaining phishing sites whose registrars don't seem to care and are unwilling to take action? Are there other parties where we could direct our complaints?