[OPEN] eXch Anti-Phishing Campaign

[apogio]

That's Proton Mail blocking your message from being sent. Have you used this email for anything else before? They really don't like it when you only send outgoing messages. Especially if you are a free account.

Yeah well, I 've got around 50 emails outgoing and around 30 incoming. I am not sure what the problem is, but I guess you 're right.
Anyway, I think I may try with another email as well, but the only one which I think I could use has even less emails.

[SamReomo]

Yeah well, I 've got around 50 emails outgoing and around 30 incoming. I am not sure what the problem is, but I guess you 're right.
Anyway, I think I may try with another email as well, but the only one which I think I could use has even less emails.

Well, if privacy is not a big concern for you then you may use Gmail. I've reported all of the domains via Gmail and all of my mails were sent within seconds. So here gmail works pretty well.

[Cricktor]

My protonmail account is free and I rarely sent emails with it. I receive more emails from bitcoindev announcement list and another newsletter which isn't crypto related. Now I'm really a bit disappointed of protonmail, especially when their own spam blocker doesn't quite explain what went wrong.

I can only guess that's intentional to avoid real spammers from trying to bypass it, but I've only sent about 14 emails for this campaign so far and it appears the blocking from protonmail started way earlier and I confused it with spam blocking of the registrars. This sucks from protonmail.

[apogio]

My protonmail account is free and I rarely sent emails with it. I receive more emails from bitcoindev announcement list and another newsletter which isn't crypto related. Now I'm really a bit disappointed of protonmail, especially when their own spam blocker doesn't quite explain what went wrong.

I can only guess that's intentional to avoid real spammers from trying to bypass it, but I've only sent about 14 emails for this campaign so far and it appears the blocking from protonmail started way earlier and I confused it with spam blocking of the registrars. This sucks from protonmail.

Oh so you must be having the same issue with me, don't you?
Yeah it's a pain in the @@ but not much I can do unfortunately.

Well, if privacy is not a big concern for you then you may use Gmail. I've reported all of the domains via Gmail and all of my mails were sent within seconds. So here gmail works pretty well.

It is one of my big concerns, so I don't think I will use Gmail, but I am certain that if I used it, I would receive instant responses like you said.

[joker_josue]

monero[.]forex	abuse@namecheap.com
darknetbible[.]info	abuse@namecheap.com
exch[.]cd	support@nic.cd  (use BCC, not CC)
exch[.]cy	complains@nic.cy, domains@nic.cy

These are the domains that are still active, right?

I will try to make new complaints, with a different type of approach/investigation.

[Obim34]

I just saw from the main eXch thread that they successfully shifted to a new permanent domain name  exch.net. When reporting these phishing domain names, should we include which of the domain name [exch.net or  eXch.cx] as the original.

[SamReomo]

It is one of my big concerns, so I don't think I will use Gmail, but I am certain that if I used it, I would receive instant responses like you said.

Yes, if you use it then most of your reports will be sent within seconds and there won't be any failures. I've faced no failures while reporting the domains and that's why I can say that you'll also not face any such message failure issues.

[Cyberczar]

Namecheap seems kind of slow or swamped so I contacted their support via chat since I use their services.

Hello, I emailed your support regarding the activities of two phishing websites, monero.forex and darknetbible.info but nothing has been done about it.

Response;

Thank you for your patience. It appears that you recently sent an email to our Legal and Abuse department. Please allow them some time to review your request, as legal and abuse cases may take longer to process.

[Peanutswar]

monero[.]forex	abuse@namecheap.com
darknetbible[.]info	abuse@namecheap.com
exch[.]cd	support@nic.cd  (use BCC, not CC)
exch[.]cy	complains@nic.cy, domains@nic.cy

These are the domains that are still active, right?

I will try to make new complaints, with a different type of approach/investigation.

I do the same thing after I sent an email after couple of days they response just the acknowledgement so I guess another report is a must here to take down the remaining.

[roosbit]

When all these phishing sites are taken down, and as a long term solution

exch should consider buying the major TLD out there to avoid giving scammers an opportunity to clone their business!

Joined

BTC addy: bc1qlyflzvq0w0xr5wepe8xrqs50cn9sfu6gcpfe40

[Haunebu]

These are the domains that are still active, right?

I will try to make new complaints, with a different type of approach/investigation.

Namecheap isn't doing shit about any of them because it seems like they are protecting them while exch.cd and exch.cy seem damn near impossible to get rid off since they are ccTLDs and even ICANN cannot touch them.

I just saw from the main eXch thread that they successfully shifted to a new permanent domain name  exch.net. When reporting these phishing domain names, should we include which of the domain name [exch.net or  eXch.cx] as the original.

Good question. Am guessing either would be fine, but op should confirm the same.

[d5000]

exch should consider buying the major TLD out there to avoid giving scammers an opportunity to clone their business!

That's exactly what they did - they now operate under https://exch.net. That change is recent (today or yesterday) but was already announced for a while.

[Haunebu]

Just reported namecheap to ICANN with proof of them doing nothing about monero and darknet domains. Let's see if they can help. Others can complain too using below link.

https://www.icann.org/compliance/complaint

[examplens]

Hello @eXch Support please note that I had the same issue that Cricktor had.

Some emails didn’t go through.

Here is a sample screenshot of the issue:

That's Proton Mail blocking your message from being sent. Have you used this email for anything else before? They really don't like it when you only send outgoing messages. Especially if you are a free account.

To me, this even looks as if Protonmail blacklisted the exch.cx domain. There is no reason for them not to allow sending emails from their server unless they want to be connected to a blocked domain.
Maybe that pushed eXch the move to a .net domain.

[PX-Z]

exch should consider buying the major TLD out there to avoid giving scammers an opportunity to clone their business!

I guess they’re already doing it, though this is just an assumption based on my own research. When I searched for "exch" on domain registrars like Namecheap to check which TLDs were still available, I found that some were already taken but not accessible, unlike the phishing sites that were mentioned.

[ovcijisir]

Glad to see four sites down already. Is there any way to speed up things with other four sites remaining, other then calling them on phone directly?

Hope they will learn their lesson and avoid such behaviour in future.

[NotATether]

When all these phishing sites are taken down, and as a long term solution

exch should consider buying the major TLD out there to avoid giving scammers an opportunity to clone their business!

That won't stop phishing. Any domain that starts with "exch" can be utilized for scams.

[examplens]

Well, after the exch[.]cash phishing domain was shut down, the scammer reacted very quickly. On two well-known fraud domains, eXch name has been pointing to a link replaced by the new exch[.]best domain

Code:

monero[.]forex	
darknetbible[.]info

As far as I can see, it is almost the same scheme.
The domain exch[.]best is registered through Tucows partner easyDNS



I will send a new request to easyDNS, it seems to me that they were quite responsible last time.

[roosbit]

When all these phishing sites are taken down, and as a long term solution

exch should consider buying the major TLD out there to avoid giving scammers an opportunity to clone their business!

That won't stop phishing. Any domain that starts with "exch" can be utilized for scams.

After reading what you wrote, I have realized the reason the other four domains went down eadier was because these (exch[.]center, exch[.]cc, exch[.]live, exch[.]cash ) were directly involved in the phishing, but for the remaining domains the approach has to change as these are more of the affiliate business front (indirect scamming) and so the registrar will find it difficult to take them down.

[NotATether]

After reading what you wrote, I have realized the reason the other four domains went down eadier was because these (exch[.]center, exch[.]cc, exch[.]live, exch[.]cash ) were directly involved in the phishing, but for the remaining domains the approach has to change as these are more of the affiliate business front (indirect scamming) and so the registrar will find it difficult to take them down.

You have to open a support ticket and prove where your traffic comes from if you want to withdraw your affiliate earnings, and I guarantee you that eXch is not going to process any of their tickets.