[OPEN] eXch Anti-Phishing Campaign

[bitmover]

I received an email from McAfee and they seemed  to have added monero[.]forex in their blacklist

Dear Valued Customer,


Please find an update for the Email: phising domain monero.forex

Status: Resolved

TicketID: 922611

 

urls have been reviewed

 

Kind regards,

McAfee URL Customer Response Team

I have forwarded the email to exch support !

[Peanutswar]

List of active domains you can report:

Domain	Report link/email
monero[.]forex	abuse@namecheap.com + abuse@identity.digital + https://www.identity.digital/policies/report-abuse
darknetbible[.]info	abuse@namecheap.com
exch[.]cd	support@nic.cd  (use BCC, not CC)
exch[.]cy	complains@nic.cy, domains@nic.cy
exch[.]center	suspended on 2025-03-17
exch[.]cc	suspended on 2025-03-18
exch[.]live	suspended on 2025-03-23
exch[.]cash	suspended on 2025-03-25

I got lost with tons of discussion on the thread and would like to ask if this is the latest we should report? so I can submit another batch of reports.

[GazetaBitcoin]

I got lost with tons of discussion on the thread and would like to ask if this is the latest we should report? so I can submit another batch of reports.

Those 4 domains still need to be reported, yes.

As a plus, examplens also spotted another phishing name, exch[.]best. Feel free to report that one as well.

[Peanutswar]

I got lost with tons of discussion on the thread and would like to ask if this is the latest we should report? so I can submit another batch of reports.

Those 4 domains still need to be reported, yes.

As a plus, examplens also spotted another phishing name, exch[.]best. Feel free to report that one as well.

Thanks Gazeta!

I want to inform that I made another report hope they will make action now. I didn't receive any feed back to most of my emails as of now yet.

[Haunebu]

As a plus, examplens also spotted another phishing name, exch[.]best. Feel free to report that one as well.

Not sure if this is a good idea since the scammers would most probably just replace it with another phishing domain. This is why I think it would be best to report them only if exch support adds it to the phishing domain list.

[joker_josue]

Domain	Report link/email
monero[.]forex	abuse@namecheap.com + abuse@identity.digital + https://www.identity.digital/policies/report-abuse
darknetbible[.]info	abuse@namecheap.com
exch[.]cd	support@nic.cd  (use BCC, not CC)
exch[.]cy	complains@nic.cy, domains@nic.cy

After some research, I found other company emails that can be contacted to try to resolve the situation.

exch[.]cd abuse@nic.cd, david.k@ocpt.cd

exch[.]cy christos@ucy.ac.cy, constantinou.j.savvas@ucy.ac.cy

darknetbible[.]info legalandabuse@namecheap.com

monero[.]forex legalandabuse@namecheap.com


It may be useful, other users have also tried, but since they are not "official channels", try not to flood everything at once.
Maybe whenever they send it, they let you know, to give others a waiting period to send it again.

[xOrpian]

monero[.]forex legalandabuse@namecheap.com


It may be useful, other users have also tried, but since they are not "official channels", try not to flood everything at once.
Maybe whenever they send it, they let you know, to give others a waiting period to send it again.

Other domains, excluding this '.forex,' directly host phishing websites. The mentioned links of phishing websites on this domain's webpage keep changing (I wrote an email explaining this)
The phishing domain's referral link has been changed at least three times since 2024 on this 'monero[.]forex'.

Compared to others, this particular domain will have a hard time getting suspended. This website only shares links rather than direct phishing (though even then, it's not legal, but it's a good loophole the owner is exploiting).

[PX-Z]

As a plus, examplens also spotted another phishing name, exch[.]best. Feel free to report that one as well.

Not sure if this is a good idea since the scammers would most probably just replace it with another phishing domain. This is why I think it would be best to report them only if exch support adds it to the phishing domain list.

While its true that scammers can easily switch to a new domain, reporting phishing sites still helps minimize their impact and protect unsuspecting users. Even if exch doesn’t add it to their blacklist, submitting reports to anti-phishing databases, browsers, especially Google Safe Browsing and domain registrars can significantly reduce the number of victims. Every effort counts in the fight against scams.

[Haunebu]

exch[.]cd abuse@nic.cd, david.k@ocpt.cd

exch[.]cy christos@ucy.ac.cy, constantinou.j.savvas@ucy.ac.cy

darknetbible[.]info legalandabuse@namecheap.com

monero[.]forex legalandabuse@namecheap.com

Good luck trying to get replies from those .cd and .cy contacts. Those ccTLD emails are totally useless and there david one doesn't even deliver properly. Also, namecheap will probably keep protecting monero and darknet no matter how you email them.

While its true that scammers can easily switch to a new domain, reporting phishing sites still helps minimize their impact and protect unsuspecting users.

You are logically correct, but it's best to wait for exch support to give the green light in this case if you ask me. Best to focus on taking down the ones remaining in the list first.

[Woodie]

Seeing some of these registrars want intervation from local authorities for them to act, why not consider this route and maybe sending them such an email of abuse...maybe legal address or cyber division from the police 🚨they might comply faster..as it looks like they are protecting customers to secure future business transactions.

[PX-Z]

... it looks like they are protecting customers to secure future business transactions.

That's how it looks like they operate, as long as there's no subpoena from any authority, they won't do anything about it since they still benefits money from these scammers.

The case of namecheap sounds like that too, even though the proofs are obvious but they won't do so as they haven't give any follow up on my email report to them and both domain are still up.

[examplens]

hey, don't report the .best domain yet. it is needed as a reference when reporting the other two domains on which there are links to that phishing site. also, if someone has a screenshot from the previous report, which proves that domains darknetbible and .forex promoted the suspended .cash domain, I would be grateful if they could share it here.
I am preparing a complete report, so I need as much information as possible.

[paid2]

hey, don't report the .best domain yet. it is needed as a reference when reporting the other two domains on which there are links to that phishing site. also, if someone has a screenshot from the previous report, which proves that domains darknetbible and .forex promoted the suspended .cash domain, I would be grateful if they could share it here.
I am preparing a complete report, so I need as much information as possible.

Good idea. For .forex you can find a screenshot in my message here (where you can see .cash at the bottom left) https://bitcointalk.org/index.php?topic=577207.msg64976426#msg64976426

[Basels]

I sent several anti-phishing emails. So today, I decided to add my email to the BCC field after adding eXch support email address. However, I didn't receive a copy of the mail I sent. are we sure the eXch team are getting all our correspondence? Must the BCC field accommodate only one email address?
 

[Doan9269]

List of active domains you can report:

Domain	Report link/email
monero[.]forex	abuse@namecheap.com + abuse@identity.digital + https://www.identity.digital/policies/report-abuse
darknetbible[.]info	abuse@namecheap.com
exch[.]cd	support@nic.cd  (use BCC, not CC)
exch[.]cy	complains@nic.cy, domains@nic.cy
exch[.]center	suspended on 2025-03-17
exch[.]cc	suspended on 2025-03-18
exch[.]live	suspended on 2025-03-23
exch[.]cash	suspended on 2025-03-25

I got lost with tons of discussion on the thread and would like to ask if this is the latest we should report? so I can submit another batch of reports.

I also wanted to ask this same question, that if we can make a second phase report as am seing the remaining 4 not being taken down yet, if this is possible that we report more than once on those that have not been taken down, I see fewer members joining in making this report lately, but it's of no doubt a number of us have also reported as many as possible

While it's important for those reporting for the first time to take note of weekends report not being effective, therefore their reports should be on week days in other for it to count.

[Haunebu]

also, if someone has a screenshot from the previous report, which proves that domains darknetbible and .forex promoted the suspended .cash domain, I would be grateful if they could share it here.
I am preparing a complete report, so I need as much information as possible.

Already sent this stuff to Namecheap through several emails before and they gave silly excuses. They are just as worse as those ccTLD registrars who don't even respond.

[Ledumgere]

Btc address: bc1qgkkaae94xau27ngsnz94c5y5x2x8v3yjpynnre

I'll reply these domains immediately, and I'm willing to take part in the campaign.

I've completed reporting the domains as fast as possible.

[Woodie]

hey, don't report the .best domain yet. it is needed as a reference when reporting the other two domains on which there are links to that phishing site.

You just gave me another idea...

Why not use https://web.archive.org/ to archive these websites which also have these affiliate links, when the said websites go down and they get to be updated with new affiliate links, then we have our evidence that our guy is behind these phishing sites...and maybe Namecheap and other registrar's can take action.
Time, dates etc should be recorded to come up with a good lead.

[Cyberczar]

Not a bad idea reporting to Google Safe Browsing.



A central site where you can report to the security community

[eXch Support]

I also wanted to ask this same question, that if we can make a second phase report as am seing the remaining 4 not being taken down yet, if this is possible that we report more than once on those that have not been taken down, I see fewer members joining in making this report lately, but it's of no doubt a number of us have also reported as many as possible

While it's important for those reporting for the first time to take note of weekends report not being effective, therefore their reports should be on week days in other for it to count.

Absolutely. We invite you to multiply your reports.

Also, for monero[.]forex and darknetbible[.]info, we invite you to add a screenshot of their respective page from Virustotal in your reports, to mention to the registrar that they are flagged as malicious/suspicious by threat intelligence providers.

Again, we would also like to add that the most motivated and active members will receive nice bonuses.