[OPEN] eXch Anti-Phishing Campaign

[bitmover]

I just received an email that my report in metamask was accepted.

https://github.com/MetaMask/eth-phishing-detect/issues/150012

This is the result. Everyone who has a metamask installed will see this:

[PX-Z]

I just received an email that my report in metamask was accepted.

https://github.com/MetaMask/eth-phishing-detect/issues/150012

This is the result. Everyone who has a metamask installed will see this:

This is the same on using Firefox and chrome desktop version with the help of Google safe browsing which means that the URL will not show in google search page now.

But unfortunately, tried on Brave but it looks like it's not implemented yet.

[Haunebu]

I just received an email that my report in metamask was accepted.

https://github.com/MetaMask/eth-phishing-detect/issues/150012

This is good stuff, but it's just like Pmalek's OpenDNS blocks where only a particular section of the internet(MetaMask installed) see these warnings unlike Google safe browsing red warnings which is visible to everyone on the internet.

[joker_josue]

I just received an email that my report in metamask was accepted.

https://github.com/MetaMask/eth-phishing-detect/issues/150012

This is the same on using Firefox and chrome desktop version with the help of Google safe browsing which means that the URL will not show in google search page now.

But unfortunately, tried on Brave but it looks like it's not implemented yet.

That is great. The alerts given by official mechanisms are working.
The domain may remain active, but all alerts will be given regarding its content. This scoundrel, at least, will have less chance of catching victims.

[Woodie]

You people are clowns. darknetbible [.] info is not a malicious site, it's registered and hosted legally, and has direct authorization from the Bible's author to reprint it. It says to only get links from Daunt, and provides more harm reduction than any of you idiots ever will.

Your campaign is a joke and posting here is just promoting this exchange, not genuinely trying to help anything.

Like they say, "If you can't stand the heat in the kitchen , get out of the kitchen!!!"

The fact that you are here says the heat has gotten to you, do the right thing buddy, pull down that domain already and try something that doesn't make you the villain in this.

You still have time to do the right thing!

[SamReomo]

The fact that you are here says the heat has gotten to you, do the right thing buddy, pull down that domain already and try something that doesn't make you the villain in this.

I don't think that he'll ever change himself but continue calling a reputed platform like eXch as scam or wrong. Those are his words and most of us totally avoid words that come from a newbie, not to be rude but most of the newbie accounts are actually accounts of the scammers themselves and when they defend one platform that's promoting phishing links and they try to defame a reputed platform then it's more clear that the same person might be the one who has created the phishing sites and now tries his best to defame eXch so he can still scam innocent users.

[PX-Z]

exch[.]best owner is redirecting it's domain to exch.net, can anyone confirm if its the same on their end?
Idk what's the main purpose of this if the owner is tired of making its schemes or they just want to drag the .net domain now for some reason.

[xOrpian]

exch[.]best owner is redirecting it's domain to exch.net, can anyone confirm if its the same on their end?
Idk what's the main purpose of this if the owner is tired of making its schemes or they just want to drag the .net domain now for some reason.

Yes, it is, but before that, I am shown a warning of entering a dangerous website... The URL is a referral one 'https://exch.net/  ?ref=Ae1B66A6'

@eXch Support, you can check the account this ref link is associated with and take necessary action if needs be.

You people are clowns. darknetbible

How cute, you shouldn't be wasting your time on clowns then 

[PX-Z]

exch[.]best owner is redirecting it's domain to exch.net, can anyone confirm if its the same on their end?
Idk what's the main purpose of this if the owner is tired of making its schemes or they just want to drag the .net domain now for some reason.

Yes, it is, but before that, I am shown a warning of entering a dangerous website... The URL is a referral one 'https://exch.net/  ?ref=Ae1B66A6'

@eXch Support, you can check the account this ref link is associated with and take necessary action if needs be.

Ah yeah, you're right, i forgot, it was already blocked on some browser that uses Google safe browsing api such as chrome and firefox, im currently using brave and it's not yet implemented so that's why...
That referral code, idk if its legit, the .cash domain has it too before it got suspended.

[xOrpian]

exch[.]best owner is redirecting it's domain to exch.net, can anyone confirm if its the same on their end?
Idk what's the main purpose of this if the owner is tired of making its schemes or they just want to drag the .net domain now for some reason.

Yes, it is, but before that, I am shown a warning of entering a dangerous website... The URL is a referral one 'https://exch.net/  ?ref=Ae1B66A6'

@eXch Support, you can check the account this ref link is associated with and take necessary action if needs be.

Ah yeah, you're right, i forgot, it was already blocked on some browser that uses Google safe browsing api such as chrome and firefox, im currently using brave and it's not yet implemented so that's why...
That referral code, idk if its legit, the .cash domain has it too before it got suspended.

He probably gave up on the domain since now it's out in the open, and he sees no other use other than using it as a ref link to Exch's website.
This again proves that he's after commissions now, and likely created accounts and stacked them on each other to make commissions from exchanges, like eXch Support mentioned earlier.

(My previous reply was too robotic, have to stop using auto correct in grammarly...it has pros, but it distorts the flow of thoughts to a huge extent)

[TerryW]

exch[.]best owner is redirecting it's domain to exch.net, can anyone confirm if its the same on their end?
Idk what's the main purpose of this if the owner is tired of making its schemes or they just want to drag the .net domain now for some reason.

So you're being publicly paid by shady company "eXch" to spam hosts and domain registrars trying to pressure them to suspend sites that are not even remotely malicious.

"Coincidentally" you are targeting the news sites that reported on "eXch" laundering money from the ByBit hack.

BRILLIANT MINDS in this thread. Great work boys.

[examplens]

exch[.]best owner is redirecting it's domain to exch.net, can anyone confirm if its the same on their end?
Idk what's the main purpose of this if the owner is tired of making its schemes or they just want to drag the .net domain now for some reason.

Yes, I'm redirected to exch.net when I skip the warning, too. Tricky.

I just updated the https://NamecheapScamExpose.info page, added current screenshots from Firefox for both domains, exch[.]best and monero[.]forex. Maybe this makes the decision easier for Namecheap, at least when it comes to this one domain.

[PX-Z]

So you're being publicly paid by shady company "eXch" to spam hosts and domain registrars trying to pressure them to suspend sites that are not even remotely malicious.

Is your reading comprehension lacking, or are you just dumb and deliberately ignoring the point? Those two websites are clearly promoting a phishing site. Whether this campaign is paid or not, it doesn’t change the fact that it poses a risk to users of the legitimate site and violates the registrar’s policies, they should absolutely be taken down.

[examplens]

So you're being publicly paid by shady company "eXch" to spam hosts and domain registrars trying to pressure them to suspend sites that are not even remotely malicious.

Is your reading comprehension lacking, or are you just deliberately ignoring the point? Those two websites are clearly promoting a phishing site. Whether this campaign is paid or not, it doesn’t change the fact that it poses a risk to users of the legitimate site and violates the registrar’s policies, they should absolutely be taken down.

I would not be surprised if it is the owner of these domains or some kind of partner in this scam. They did not expect that it would go all the way. Now they come with newbie accounts to preach that the scammer is actually a good person, and the newly created Twitter accounts also defend the scammers.

[TerryW]

So you're being publicly paid by shady company "eXch" to spam hosts and domain registrars trying to pressure them to suspend sites that are not even remotely malicious.

Is your reading comprehension lacking, or are you just dumb and deliberately ignoring the point? Those two websites are clearly promoting a phishing site. Whether this campaign is paid or not, it doesn’t change the fact that it poses a risk to users of the legitimate site and violates the registrar’s policies, they should absolutely be taken down.

What is the phishing site they are "CLEARLY" promoting? exch[.]best redirects to exch[.]net.

You might not be as smart as you think you are. Consider that next time you attempt to insult someone.

[PX-Z]

What is the phishing site they are "CLEARLY" promoting? exch[.]best redirects to exch[.]net.

You might not be as smart as you think you are. Consider that next time you attempt to insult someone.

There it is, the classic scammer sleight of hand. You’re trying to blur the line between exch[.]best and exch.net like they’re the same thing, they’re not.
But now that the .best domain suddenly redirects to the real site, and you expect people to believe that makes everything okay? That’s not a defense, that’s damage control. It’s like setting a fire, getting caught, then pointing to the ashes and saying, "See? No fire here." Either way, you’re not fooling anyone here.

I would not be surprised if it is the owner of these domains or some kind of partner in this scam. They did not expect that it would go all the way. Now they come with newbie accounts to preach that the scammer is actually a good person, and the newly created Twitter accounts also defend the scammers.

Its defending the sites like they are pure innocent so high chance its connected to those sites.

[TerryW]

What is the phishing site they are "CLEARLY" promoting? exch[.]best redirects to exch[.]net.

You might not be as smart as you think you are. Consider that next time you attempt to insult someone.

There it is, the classic scammer sleight of hand. You’re trying to blur the line between exch[.]best and exch.net like they’re the same thing, they’re not.
But now that the .best domain suddenly redirects to the real site, and you expect people to believe that makes everything okay? That’s not a defense, that’s damage control. It’s like setting a fire, getting caught, then pointing to the ashes and saying, "See? No fire here." Either way, you’re not fooling anyone here.

I would not be surprised if it is the owner of these domains or some kind of partner in this scam. They did not expect that it would go all the way. Now they come with newbie accounts to preach that the scammer is actually a good person, and the newly created Twitter accounts also defend the scammers.

Its defending the sites like they are pure innocent so high chance its connected to those sites.

It redirects to an eXch affiliate link, not a phishing site. You are stupid as fuck.

I am not defending phishing sites. I'm calling you and everyone else here an idiot for helping eXch attack news sites and resources that have reported on them laundering money for ByBit hackers.

[PX-Z]

It redirects to an eXch affiliate link, not a phishing site. You are stupid as fuck.

I am not defending phishing sites. I'm calling you and everyone else here an idiot for helping eXch attack news sites and resources that have reported on them laundering money for ByBit hackers.

You remind me that intelligence comes in many forms. Yours just… isn’t one of them. You call this not a phishing site?


https://web.archive.org/web/20250328113453/http://exch.best/

And now, you are playing dumb that the site is just an affiliate website redirecting to the main website after Google safe browsing flagged it as unsafe?
I’m all ears. What’s the next gem of stupidity you’ve got for us?

[Haunebu]

At this point, I am not expecting any of the remaining 4 sites to get suspended unless authorities intervene which is why getting them blacklisted somehow through scam@netcraft.com, Google safe browsing etc is the next best option.

Exch.cd already got blacklisted recently leaving 3 remaining currently.

Edit: Netcraft found no threats related to monero.forex and darknetbible.info despite providing them the site created by examplens, but they did blacklist exch.best and exch.cd recently. Weird!

[joker_josue]

So you're being publicly paid by shady company "eXch" to spam hosts and domain registrars trying to pressure them to suspend sites that are not even remotely malicious.

Is your reading comprehension lacking, or are you just dumb and deliberately ignoring the point? Those two websites are clearly promoting a phishing site. Whether this campaign is paid or not, it doesn’t change the fact that it poses a risk to users of the legitimate site and violates the registrar’s policies, they should absolutely be taken down.

What is the phishing site they are "CLEARLY" promoting? exch[.]best redirects to exch[.]net.

You might not be as smart as you think you are. Consider that next time you attempt to insult someone.

You are indeed being very clever in your scheme.

Its scheme and purpose is simple. Since browsers have already started blocking this domain, their strategy has changed. It redirects the domain to the real site, and then goes to the browser to request the suspension to be removed, pretending to be the owner of the real site. You will say "I finally managed to get this domain from the previous owner, and now it is pointing to my website, the domain is no longer a scam, but is part of the list of official eXch domains".

The owner of exch[.]best is trying to do this as well, and has even updated the domain information.
https://www.whois.com/whois/exch.best
https://whois-history.whoisxmlapi.com/lookup-report/0mk8aQqoRb
https://whoisfreaks.com/tools/whois/history/lookup/exch.best


I suggest that we try again, with the registrar, to inform what is happening with this domain exch[.]best.