[OPEN] eXch Anti-Phishing Campaign

[roosbit]

After reading what you wrote, I have realized the reason the other four domains went down eadier was because these (exch[.]center, exch[.]cc, exch[.]live, exch[.]cash ) were directly involved in the phishing, but for the remaining domains the approach has to change as these are more of the affiliate business front (indirect scamming) and so the registrar will find it difficult to take them down.

You have to open a support ticket and prove where your traffic comes from if you want to withdraw your affiliate earnings, and I guarantee you that eXch is not going to process any of their tickets.

You misunderstood me, of course eXch won't be paying any affiliate rewards but the scammers real scam is having a smoke screen of their scamming websites.

Btw new platform to nuke is on the table, compliments of monero forex affiliate site.

exch[.] best

This made me just realize the big culprit here is that monero forex website, keeps updating the affiliate link or creating new websites , so we bust that guy then the whole operation goes down..

We are about to get the whole alphabet of TLDs handed to us.

[eXch Support]

We'd like to emphasize that we need to focus our efforts on the domains listed.
We have updated some contacts:

Domain	Report link/email
monero[.]forex	abuse@namecheap.com + abuse@identity.digital + https://www.identity.digital/policies/report-abuse
darknetbible[.]info	abuse@namecheap.com
exch[.]cd	support@nic.cd  (use BCC, not CC)
exch[.]cy	complains@nic.cy, domains@nic.cy

Domains registered with Namecheap are difficult to get suspended, so feel free to call them, send to their headquarters a physical letter, or to mention/tag them on social networks. Any action can help.

Also this might increase motivation of the registrar to suspend these domains if they're marked as phishing by threat intelligence providers, so feel free to report the phishing domains to the following contacts too:

jeremy@alphamountain.ai
info@seclookup.com
info@avtest.de
sites@mcafee.com
support@novirusthanks.org
support@opendns.com
hello@zerocert.org
hello@windscribe.com
yegor@windscribe.com
contact@mnemonic.io
info@socradar.io
support@abusix.com
emilia@quad9.net

We would also like to add that the most motivated and active members will receive nice bonuses.

[examplens]

We'd like to emphasize that we need to focus our efforts on the domains listed.

However, I decided not to report the new phishing domain to easyDNS for now, because Namecheap needs it as evidence that the owner of the two domains has explicit scam intent.

[Haunebu]

I will send a new request to easyDNS, it seems to me that they were quite responsible last time.

Found out about exch.best sometime back and informed exch support, but didn't want to take action against them without the domain getting added to the list. Also, I believe Tucows ultimately took down exch.cash as xorpian pointed out(Not easyDNS).

Domains registered with Namecheap are difficult to get suspended, so feel free to call them, send to their headquarters a physical letter, or to mention/tag them on social networks. Any action can help.

Already tried other ways of putting pressure on Namecheap earlier, but they keep protecting those scam sites.

https://www.reddit.com/r/NameCheap/comments/1jh5yrf/namecheap_protecting_phishing_domains/

This is why I reported them to ICANN, but there's still no update from them. Reported abuse to identity digital too.

[examplens]

Already tried other ways of putting pressure on Namecheap earlier, but they keep protecting those scam sites.

https://www.reddit.com/r/NameCheap/comments/1jh5yrf/namecheap_protecting_phishing_domains/

This is why I reported them to ICANN, but there's still no update from them. Reported abuse to identity digital too.

After the Twitter correspondence, the priority is to check my report. I got a similar answer to this one from Reddit. They suggest that we report these sites to the hosting company.

About exch[.]cd, it is recommended to contact support@nic.cd. Well, the nic.cd website has slightly different information.
As much as g-translate served me, I conclude that nic.cd is no longer authorized for .cd domains and that the Société Congolaise des Postes et Télécommunications (SCPT, formally OCPT) is in charge of all actions about .cd domains.

Translated by Google

Please note that the Société Congolaise des Postes et Télécommunications (SCPT, formerly OCPT), the representative of the government of the Democratic Republic of Congo for the management of the national .CD domain name is now the only operator authorized to accept registrations and updates for .CD domain names.

original

Code:

Migration du Registre ccTLD .CD
(English version following)
Chers Partenaires Registraires,

Veuillez prendre note que la Société Congolaise des Postes et Télécommunications (SCPT ex-OCPT), mandataire du gouvernement de la République Démocratique du Congo pour la gestion du nom de domaine national .CD est désormais le seul opérateur habilité à accepter les enregistrements et les mises à jour sur les noms de domaines .CD.

Nous arrivons à la fin du processus du déploiement de l'infrastructure de gestion du Registre .CD sous le contrôle total de la Société Congolaise des Postes et Télécommunications (SCPT)

À ce stade nous sommes en mesure d'effectuer de notre coté la mise à jour des enregistrements DNS de vos clients pour le ccTLD .CD

Merci de bien vouloir rentrer en contact avec nous par eMail (support AT nic.cd) pour recevoir les instructions permettant de regagner votre accès de Registraire accrédité au Registre .CD

Par ailleurs veuillez noter que les entreprises CONIC (http://conic.africa) et Webnet Africa (http://www.webnetafrica.net) ne sont plus habilités à gérer le Registre du ccTLD .CD et que par ailleurs ils ne sont pas des Registraires Accrédités du ccTLD .CD

Par conséquent, veuillez transmettre à la SCPT toute requête de facturation pour les renouvellements ou enregistrements du .CD provenant de CONIC ou Webnet Africa, et nous régulariserons la situation pour vous.
Aucun crédit ne sera accordé pour les paiements fait à CONIC ou Webnet Africa pour des noms de domaine en .CD après le 30 Septembre 2017.

L'équipe du Registre .CD

I found them on https://scpt.cd/web/#/ and the only email contact is info@scpt.cd. I sent the report to this address, but since it's the weekend, I don't expect an answer before Monday

As far as I understand, it's about the French language, maybe someone more familiar with French can help. Mention @paid2

[xOrpian]

Already tried other ways of putting pressure on Namecheap earlier, but they keep protecting those scam sites.

https://www.reddit.com/r/NameCheap/comments/1jh5yrf/namecheap_protecting_phishing_domains/

This is why I reported them to ICANN, but there's still no update from them. Reported abuse to identity digital too.

I do not think Namacheap is trying to protect these phishing websites. The recent website 'exch[.]live' was reported to Namecheap and was taken down the next day I made the report (in my case).
If Namecheap were trying to protect these websites, they'd have done the same for the '.live' domain.

I'll write another email and see if it works. I asked for their contact number from live support, but they don't have telephone support—just mail.

[paid2]

As far as I understand, it's about the French language, maybe someone more familiar with French can help. Mention @paid2

Yeah indeed you're right but it seems that the address they advise to contact is still support@nic.cd.

Here is the translation of the text to English:

Migration of registered ccTLD .CD
Dear registrars partners,

Please note that the Congolese Society of Telecommmunications (SCPT - former OCPT), agent of the government of the Democratic Republic of Congo for the management of the .CD national domain name, is now the only operator authorized to accept registrations and updates on .CD domain names.

We are coming to the end of the process of deploying the .CD registry management infrastructure under the total control of SCPT.

At this stage we can update your customers' DNS records for the .CD ccTLD on our side.

Please contact us by eMail (support@nic.cd) to receive instructions on how to regain your accredited Registrar access to the .CD Registry.

Please note that CONIC (http://conic.africa) and Webnet Africa (http://www.webnetafrica.net) are no longer authorized to manage the .CD ccTLD Registry and are not Accredited Registrars of the .CD ccTLD.

Therefore, please forward any billing requests for .CD renewals or registrations from CONIC or Webnet Africa to SCPT, and we will regularize the situation for you.
No credit will be given for payments made to CONIC or Webnet Africa for .CD domain names after September 30, 2017.

The .CD Registry team

[GazetaBitcoin]

the only email contact is info@scpt.cd. I sent the report to this address, but since it's the weekend, I don't expect an answer before Monday

I tried this email as well... but just like in my previous attempt, I received an email from Mailer Daemon, saying the email was not sent, sigh...

Also this might increase motivation of the registrar to suspend these domains if they're marked as phishing by threat intelligence providers, so feel free to report the phishing domains to the following contacts too:

jeremy@alphamountain.ai
info@seclookup.com
info@avtest.de
sites@mcafee.com
support@novirusthanks.org
support@opendns.com
hello@zerocert.org
hello@windscribe.com
yegor@windscribe.com
contact@mnemonic.io
info@socradar.io
support@abusix.com
emilia@quad9.net

We would also like to add that the most motivated and active members will receive nice bonuses.

I just did as well, adding you in the Bcc of the email. Let's hope this will work...

[Haunebu]

I found them on https://scpt.cd/web/#/ and the only email contact is info@scpt.cd. I sent the report to this address, but since it's the weekend, I don't expect an answer before Monday.

I doubt they will ever answer because I already found about SCPT registry and shared a link in one of my earlier posts where we submit abuse reports. They never responded till date.

I do not think Namacheap is trying to protect these phishing websites. The recent website 'exch[.]live' was reported to Namecheap and was taken down the next day I made the report (in my case).
If Namecheap were trying to protect these websites, they'd have done the same for the '.live' domain.

They don't protect all of them, but they do protect some. I literally sent them several emails with proper proof, but they just invalidated my claims. They even locked my reddit post immediately which says a lot. Cheapsters indeed.

jeremy@alphamountain.ai
info@seclookup.com
info@avtest.de
sites@mcafee.com
support@novirusthanks.org
support@opendns.com
hello@zerocert.org
hello@windscribe.com
yegor@windscribe.com
contact@mnemonic.io
info@socradar.io
support@abusix.com
emilia@quad9.net

Just finished reporting to them. Hope they can blacklist them unlike Google and Microsoft who didn't really do anything.

[Cyberczar]

We'd like to emphasize that we need to focus our efforts on the domains listed.
We have updated some contacts:

Domain	Report link/email
monero[.]forex	abuse@namecheap.com + abuse@identity.digital + https://www.identity.digital/policies/report-abuse
darknetbible[.]info	abuse@namecheap.com
exch[.]cd	support@nic.cd  (use BCC, not CC)
exch[.]cy	complains@nic.cy, domains@nic.cy

Domains registered with Namecheap are difficult to get suspended, so feel free to call them, send to their headquarters a physical letter, or to mention/tag them on social networks. Any action can help.

Also this might increase motivation of the registrar to suspend these domains if they're marked as phishing by threat intelligence providers, so feel free to report the phishing domains to the following contacts too:

jeremy@alphamountain.ai
info@seclookup.com
info@avtest.de
sites@mcafee.com
support@novirusthanks.org
support@opendns.com
hello@zerocert.org
hello@windscribe.com
yegor@windscribe.com
contact@mnemonic.io
info@socradar.io
support@abusix.com
emilia@quad9.net

We would also like to add that the most motivated and active members will receive nice bonuses.

Here re more threat intel platforms to report to:


PhishTank (OpenDNS): submit@phishtank.com

Google Safe Browsing: https://safebrowsing.google.com/safebrowsing/report_phish/

Microsoft Defender SmartScreen: phish@microsoft.com

Spamhaus: https://www.spamhaus.org/report/

APWG (Anti-Phishing Working Group): reportphishing@apwg.org

VirusTotal: Submit via https://www.virustotal.com/

[PX-Z]

So, the two sites from Namecheap are still up. I never reported them before since they weren’t phishing sites, as I mentioned earlier. But today, I finally did, with evidence, including screenshots, WHOIS data, and archived URLs of the scam-promoting links. 

Let’s see how it goes. Not to mention, my success rate with Namecheap reports is above 90%, lol. Fingers crossed!

[Haunebu]

I don't think namecheap is going to do shit about monero.forex and darknetbible.info. They keep protecting them for reasons that only they are aware of even after providing them proper proof. Pathetic domain registration service.

[Knight Hider]

I do not think Namacheap is trying to protect these phishing websites. The recent website 'exch[.]live' was reported to Namecheap and was taken down the next day I made the report (in my case).

It looks like Namecheap takes down the phishing sites themselves, but not the sites linking to and promoting phishing sites on other domains.

[paid2]

I don't think namecheap is going to do shit about monero[DOT]forex and darknetbible[DOT]info. They keep protecting them for reasons that only they are aware of even after providing them proper proof. Pathetic domain registration service.

They never even got back to me about the two sites in question...
For darknetbible[DOT]info, perhaps you could tell them that the domain is marked as “malicious” and “suspicious” on VirusTotal, which should help them understand the malicious nature of this site?
That, together with the other reports, evidences provided already etc., should be enough if they're acting in good faith.

[Woodie]

We would also like to add that the most motivated and active members will receive nice bonuses.[/b]

Does this motivated mean being active on this thread or engaging all shared service provides from that email list to do something about the phishing site Because others are working in silence and forwarding works to the support email address to complete task and register efforts.

Here re more threat intel platforms to report to:


PhishTank (OpenDNS): submit@phishtank.com

Google Safe Browsing: https://safebrowsing.google.com/safebrowsing/report_phish/

Microsoft Defender SmartScreen: phish@microsoft.com

Spamhaus: https://www.spamhaus.org/report/

APWG (Anti-Phishing Working Group): reportphishing@apwg.org

VirusTotal: Submit via https://www.virustotal.com/

Was about to share a similar list after going to YouTube on how to put an end to phishing sites.

And this Youtube lad claims he single handedly stopped the phishing site...those interested in seeing the informative YouTube Video [ThioJoe] >>>>https://youtu.be/0fIUiv9-UFk?si=yziXqExvBm9OsHmz

[Haunebu]

A positive update. Opendns got back to me and told me that they blocked monero.forex and darknetbible.info on their servers. Wish cloudflare etc would follow suit.

[bitmover]

There is a new one, a link from monero[.]forex

Exch[.]best

We need to take this one down too!!

Code:

Registrar Info
Name
Tucows.com Co.
Whois Server
whois.tucows.com
Referral URL
http://www.tucows.com/
Status
clientTransferProhibited https://icann.org/epp#clientTransferProhibited
clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Important Dates
Expires On
2026-01-21
Registered On
2025-01-21
Updated On
2025-03-28

[Woodie]

There is a new one, a link from monero[.]forex

Exch[.]best

We need to take this one down too!!

Code:

Registrar Info
Name
Tucows.com Co.
Whois Server
whois.tucows.com
Referral URL
http://www.tucows.com/

Seeing Tucows there gives hope that this domain can be taken down as these guys do take action unlike namecheap who don't want to take responsibility or  protect other businesses from thieves but will refer you to local authorities for action , namecheap is such a joke of a registrar..come on do your damn job!!

Why do I get a feeling we have an intern at the wheel of namecheap  

Emails sent, fingers crossed something starts to happen.

monero[.]forex   abuse@namecheap.com + abuse@identity.digital + https://www.identity.digital/policies/report-abuse
darknetbible[.]info   abuse@namecheap.com
exch[.]cd   support@nic.cd  (use BCC, not CC)
exch[.]cy   complains@nic.cy, domains@nic.cy

jeremy@alphamountain.ai
info@seclookup.com
** info@avtest.de. **
sites@mcafee.com
support@novirusthanks.org
support@opendns.com
hello@zerocert.org
hello@windscribe.com
yegor@windscribe.com
contact@mnemonic.io
info@socradar.io
support@abusix.com
emilia@quad9.net
__________________________________
Anybody else got this error for "info@avtest.de "

[Lucius]

I don't think namecheap is going to do shit about monero.forex and darknetbible.info. They keep protecting them for reasons that only they are aware of even after providing them proper proof. Pathetic domain registration service.

They protect their financial interests and literally don't care if criminals use their service as long as they pay - and the only way they can react is obviously if they receive an official notification from some government agency or police. We should avoid this company as much as possible and in this way send them a message about what we think of them.

[Knight Hider]

Darknetbible is a copy of https://tortimes.com/bible, which does not have the phishing link. Is copyright worth reporting to Namecheap?