[OPEN] eXch Anti-Phishing Campaign

[PX-Z]

I created a page where all the information about the two domains darknetbible[.]info and monero[.]forex is presented. Now we can publicly invite them to solve these cases.

https://NamecheapScamExpose.info

It is OK for anyone to share this through a future email report or social media

Monero[.]forex change its registrars to 1api.net which was probably transfered yesterday. I just learned this when i asked namecheap for follow up.

While darknetbible is still the same registrar but i see some pending transfer status probably to the same registrar as well or anywhere else.

So i guess you will need to update your domain to something general instead of having the registrar name on it. But AFAIK it takes time at least 30 days or so before you can transfer domain to another registrar again. So scammer will stick to this registrar for a while.

[examplens]

Monero[.]forex change its registrars to 1api.net which was probably transfered yesterday. I just learned this when i asked namecheap for follow up.

While darknetbible is still the same registrar but i see some pending transfer status probably to the same registrar as well or anywhere else.

So i guess you will need to update your domain to something general instead of having the registrar name on it. But AFAIK it takes time at least 30 days or so before you can transfer domain to another registrar again. So scammer will stick to this registrar for a while.

Great, it means the campaign is doing its job.
To begin with, I will only update with new changes, certainly, all the relevant information is on the site, so it can also be used for the new registry.  This is just one more reason for the new registry to grant the suspension. (I'm unsure why Namecheap dragged its feet so much and somehow protected this scammer.)

As for the domain name itself, it had to be something that would attract NC's attention. As for the domain name itself, it had to be like that to draw NC's attention. The scammer has already said that he also has a domain like moneronews[.]com, which I assume he will activate at some point, and it is also registered with Namecheap. So the current domain could be relevant in the future.

Good catch PX-Z

[Haunebu]

Good one PX-Z. I just emailed abuse reports to both 1api gmbh(New Monero.forex registrar) and EasyDNS(New Darknetbible.info registrar). @eXch Support needs to update their contact details in their main post.

Monero.forex : 1api : abuse@1api.net
Darknetbible.info : easyDNS : abuse@easydns.com

Am actually surprised that the scammer switched registrars to be honest.

so it can also be used for the new registry.  This is just one more reason for the new registry to grant the suspension.

It's registrar(Not registry).

[joker_josue]

Am actually surprised that the scammer switched registrars to be honest.

I am not. This is an excellent strategy to protect the domain.

In fact, this change may be the reason why Namecheap did not take action. Sometimes change requests take several days, as codes have to be shared during the process. When the process begins, the originating company no longer has that domain in its possession, even though the information is still on its side. For confidentiality reasons, they could not say that it was in the process of moving. I'm not trying to defend them here, just looking for a reason for their more passive attitude.

Most likely, the request for change must have occurred at the beginning of this "campaign". This action began on March 14th, and began to have effects 3 to 5 days later. Seeing what was happening, he activated the registrar transfer request. The request probably occurred on 2025-04-06.


However, in the case of monero[.]forex I found another revealing proof of how the domain is part of the scheme:

https://whoisfreaks.com/tools/whois/history/lookup/monero.forex

In February, the domain was updated to be on the same server as exch[.]cash
This is clear proof that it is the same owner.

[Haunebu]

In February, the domain was updated to be on the same server as exch[.]cash
This is clear proof that it is the same owner.

Great analysis. Your reasoning makes a lot of sense though I still don't understand why Namecheap wouldn't just reveal the entire truth now that they aren't their registrar anymore thanks to which their confidentiality agreement(If there was one) is void now.

We can definitively say that the scammer is sweating because of our combined effort and that's a win for us.

[Asiska02]

Friends, the Anti-Phishing campaign continues. We want to get these malicious domains suspended.

I know everything has an ending date but I wasn't expecting such end of a platfor like eXch but still whatever happens only happens for good. I hope all of those who contributed to this campaign in one way or other will get rewarded for their time and contribution. Especially, the members who contributed most deserve extra bonus. However, it's always going to be decision of eXch team.

We guarantee that the rewards will be distributed accordingly to the conditions stipulated in the first message of this thread. The first payments will be distributed soon.

We're behind exch. I am appalled with the ecosystem. To know what the centralized exchanges do and to see exch be persecuted over them is disgraceful, and a hit to both entrepreneurship and privacy. To also know that this roots from a result of bybit's own security flaws, is even more disappointing. If Bybit never got hacked, exch would probably not have the labels they now have. Yet, bybit continues operating warning-free despite losing $1.5 billion.

This is very more clear now that the fight against privacy is what they’re after and not some centralised system that they can control and do anything they wish with. eXch has really stands out on its privacy policy and still standing on that existing protocol for years now in their mode of operation. It is sad they’re leaving this way just when they decided to fish out those scam websites impersonating them. Just when we thought privacy is winning again through our collective efforts and then we hear such sad news, hopefully it is for the best and one day we get the last laugh that privacy prevails over every other in the crypto space.

[NotATether]

I created a page where all the information about the two domains darknetbible[.]info and monero[.]forex is presented. Now we can publicly invite them to solve these cases.

https://NamecheapScamExpose.info

It is OK for anyone to share this through a future email report or social media

If it helps, I'm going to clone the darknet bible and publish it on another site (sans phishing links).

[Kavelj22]

Reminder for those who have not yet done so (there are still 24 hours left):

We invite users who have reported the suspended domains (.center, .cc, .live, .cash) to send us an email to support@exch.cx using the object "eXch Bitcointalk Campaign Participant Information - [YOUR_USERNAME]" including your bitcoin address in the email.
We ask you to send us this email from the same email address you used to make the reports.

We've sent an e-mail to those who haven't given us their username earlier today, this information is required to be eligible for the reward.

Unfortunately, I didn't pay attention to this notification and didn't receive any confirmation email. I just realized that the 24-hour period had expired, so I sent the confirmation email hoping I didn't miss the opportunity.
Thank you for your understanding, and I'm still actively reporting the remaining domains to combat phishing and scam.

By the way, i am still receiving emails from twocows, while get no response from namecheap.

[Ucy]

Does the real exch (exch.cx/exch.net) own the Twitter page the phishing sites displayed below their websites?

I noticed the Twitter page has the real exch link (exch.cx)on its page. That could be one of the best proves to get the phishing sites shutdown by the company/companies they registered under assuming the companies are informed, trustworthy enough or serious about shutting down scams

[albon]

Does the real exch (exch.cx/exch.net) own the Twitter page the phishing sites displayed below their websites?

I noticed the Twitter page has the real exch link (exch.cx)on its page. That could be one of the best proves to get the phishing sites shutdown by the company/companies they registered under assuming the companies are informed, trustworthy enough or serious about shutting down scams

Based on this [post] from eXch Support, this is indeed their page on X, which bears the name Sarah Nugent (eXch).

I also checked other social media links on phishing sites that are still active, and it appears that they are using the official links for eXch. All the pages contain the official domain of eXch. Therefore, @examplens can incorporate this evidence into his site, which he created for use in reports. I hope this is helpful, and we can manage to take down the remaining domains, although I see it as difficult. But we must try again.

Darknetbible.info : easyDNS : abuse@easydns.com

I received this message recently, where they informed me that they are unable to take down the domain and require legal documents within a valid jurisdiction.

[Haunebu]

I received this message recently, where they informed me that they are unable to take down the domain and require legal documents within a valid jurisdiction.

Yeah. I received the same email too. Exch team could send a DMCA takedown notice to easyDNS to assist them, but it's tough to tell if that would work or not.

[PX-Z]

Google Safe Browsing has flagged the domain exch[.]cd as a phishing or deceptive site, which means browsers like Chrome and Firefox will now display warning messages to users visiting it. On the other hand, exch[.]cy hasn't been flagged yet. Still, this is a positive development, having at least one of the domains identified and warned about is better than nothing. Hopefully, similar action will follow for the other domain soon.

[nutildah]

Just in case you didn't see it before, eXch is shutting down on May 1st.

[PX-Z]

Just in case you didn't see it before, eXch is shutting down on May 1st.

Yes, it was mentioned earlier on the previous page, but this anti-phishing campaign is still actively ongoing.

Friends, the Anti-Phishing campaign continues. We want to get these malicious domains suspended.

An update, while monero[.]forex has removed the exch[.]best link from its site, the phishing URL still remains visible on the darknetbible website.

[SamReomo]

An update, while monero[.]forex has removed the exch[.]best link from its site, the phishing URL still remains visible on the darknetbible website.

That's still a good update and I hope the darknetbible website will also remove the link from its site. But, the purpose of the campaign was to suspend those domains however, their registers double standards and allowing of scam and phishing domain failed us from doing that.

[examplens]

The pressure on the scammer seems to be paying off somehow
Things are developing further. I got this message, I should probably take it as a threat. Given that Namecheap has the information of the person behind these domains, a possible report to the authorities could be reasonable.

[bias]

The pressure on the scammer seems to be paying off somehow
Things are developing further. I got this message, I should probably take it as a threat. Given that Namecheap has the information of the person behind these domains, a possible report to the authorities could be reasonable.

Not probably, it is a crystal clear threat. However, how and who will report this fuc**r to the authorities? I think that the whole procedure for doing it would be a mess.

@eXch Support: I'm sorry that I didn't participate from the start in this initiative, but it's never too late to help. Since I'm out of my base, emails will be sent the moment I get back (a day or two).

I received this message recently, where they informed me that they are unable to take down the domain and require legal documents within a valid jurisdiction.

"Anecdotal statements"...?! What a great response from a serious company, my a**!

[Obim34]

The pressure on the scammer seems to be paying off somehow
Things are developing further. I got this message, I should probably take it as a threat. Given that Namecheap has the information of the person behind these domains, a possible report to the authorities could be reasonable.

I agree with your idea, reporting him further to more authorities can help bring him down including all his phishing propaganda. This is a physical threat that should be treated as a huge case of urgency. It might also be a false threat, but his stupidity spitting out this nonsense makes it a case against him.

This should be included in his case file, we should be step ahead of him now just by reporting to reasonable authorities.

[TerryW]

The pressure on the scammer seems to be paying off somehow
Things are developing further. I got this message, I should probably take it as a threat. Given that Namecheap has the information of the person behind these domains, a possible report to the authorities could be reasonable.

https://talkimg.com/images/2025/04/20/xeJ8C.jpeg

I agree with your idea, reporting him further to more authorities can help bring him down including all his phishing propaganda. This is a physical threat that should be treated as a huge case of urgency. It might also be a false threat, but his stupidity spitting out this nonsense makes it a case against him.

This should be included in his case file, we should be step ahead of him now just by reporting to reasonable authorities.

This message is a clear show of support for the person and well wishes for his personal safety, after fucking with dangerous criminal organizations who have lots of money to spend on potential retaliation.

There is no threat, direct or implied.

[nutildah]

This message is a clear show of support for the person and well wishes for his personal safety, after fucking with dangerous criminal organizations who have lots of money to spend on potential retaliation.

There is no threat, direct or implied.

Wow bro. You are a complete piece of shit. You're clearly too stupid to even be a scammer. Take your L and put your McDonald's hat back on.