[OPEN] eXch Anti-Phishing Campaign

[God Of Thunder]

Well, I did not pay attention to this campaign. It seems the fourth domain is already suspended. I am not sure if this campaign is still open or not, it seems the reward is already sent. But the thread title says it's open. Can I still participate and report those domains that are still active?

[katanic97]

Well, I did not pay attention to this campaign. It seems the fourth domain is already suspended. I am not sure if this campaign is still open or not, it seems the reward is already sent. But the thread title says it's open. Can I still participate and report those domains that are still active?

Yes, it’s still open, the goal is to take down the remaining domains.You can still apply and report domains.
These rewards were paid out for the domains that were already taken down.

[joker_josue]

We thank you for the work done, and we encourage you to continue the good work for the domains that are still online.

We are the ones who are grateful.

Now, let's continue looking to block these other domains. Which will be more complicated, because of its characteristics. We have to keep looking for other approaches, even when we don't get answers.

[Hyphen(-)]

I am interested in joining this campaign.

bc1q3rd8233qk8kwuk99cj42p4c4qkaku8j3ker9z0

[God Of Thunder]

----

Ok.
I read the first three pages to see if anyone had asked this question, and it seems none had. So, I feel like this is a dumb question. I have checked the first two domains, which are

Code:

monero.forex
darknetbible.info

How should people report them? These websites are not a phishing of Exch. So, when someone reports these websites to the register, what should they mention about these websites? If they are not phishing, what are they?

BTC address: bc1qqrnus8u66ma9avncyct55tu7p3c8lnlwn3fczc
Update: I reported two domains.
I will wait for exch to answer the question I asked.

[Text]

Hello eXch Support,

Just reporting back that I’ve completed a second wave of reports for the following still-active domains:

1.) monero[.]forex → reported to abuse@1api.net + legal@1api.net + abuse@identity.digital
2.) darknetbible[.]info → reported to abuse@namecheap.com + abuse@easydns.com
3.) exch[.]cd → reported to support@nic.cd
4.) exch[.]cy → reported to complains@nic.cy, domains@nic.cy

As advised, I’ve included VirusTotal screenshots showing threat flags for all four domains, and I’ve ensured to BCC support@exch.cx on each submission.

Appreciate the campaign’s transparency. Let's get the rest of these malicious domains taken down!

BTC Address: bc1q5paqsvql3t65fqj3szfqalm2r4ud38kjhny5kdhkw6u4d0kwrkrs97943j

[DYING_S0UL]

----

Ok.
I read the first three pages to see if anyone had asked this question, and it seems none had. So, I feel like this is a dumb question. I have checked the first two domains, which are

Code:

monero.forex
darknetbible.info

How should people report them? These websites are not a phishing of Exch. So, when someone reports these websites to the register, what should they mention about these websites? If they are not phishing, what are they?

They are not directly linked to phishing but they are being used as a medium for spereding the phishing links..To simply put these two websites are like bloging sites where verious tips and tricks are shared. And among those guide or tutorials, there exists the phishing domain link. Users are being redirected to the fake ones where it should be the original one.

Regarding reporting, make the report in such way which explains the situation. In this case, for me, I wrote something similar to this, "I am reporting the domain monero.forex for suspected phishing activities. This domain promotes a link to a fraudulent exchange, https://[exch!cash] [breaking the link] which impersonates the legitimate exchange exch.cx (Cc-ed). I urge immediate action to suspend the domain".

[bitmover]

Regarding reporting, make the report in such way which explains the situation. In this case, for me, I wrote something similar to this, "I am reporting the domain monero.forex for suspected phishing activities. This domain promotes a link to a fraudulent exchange, https://[exch!cash] [breaking the link] which impersonates the legitimate exchange exch.cx (Cc-ed). I urge immediate action to suspend the domain".

I just noticed that monero[.]forex just removed Exch from their website


https://monero.forex/anonymous-crypto-exchanges/

[DYING_S0UL]

...snip..

I just noticed that monero[.]forex just removed Exch from their website


https://monero.forex/anonymous-crypto-exchanges/

So I guess, we can conclude this case to be solved since they choose to remove the phishing link. Although we couldn't suspend their domain, at least it's better than zero progress.

[bitmover]

I can confirm that both monero[.]forex and darknetbible both removed eXch phising links from their domains. Could be a temporary move or not.


https://darknetbible.info/bible/cryptocurrencies/converting/

https://monero.forex/anonymous-crypto-exchanges/

[roosbit]

Pressure was applied to the extent of removing links by themselves, big win team Bitcointalk.
I wouldn't  be surprised if registrars could have communicated this continued communication(emails) from the community to them.

https://monero.forex/anonymous-crypto-exchanges/

Does that mention of eXch remain as a link or it's just colored text?

[Sticky Bomb]

I'm interested in participating,

My BTC address: bc1q85589gy79he7xtatdzn8q503u6spx8jvmv88dh

[Peanutswar]

I just want to inform you that ive sent another batch of reports for the remaining domains so we can take it down.

[Lucius]

The rewards have been distributed for the 4 domains that are already suspended.

TXID: 61792cf9a1cdedf9b0d4bc676741dcf3ba8c85ecfcab83e64e2a626d67b1d617
---
We thank you for the work done, and we encourage you to continue the good work for the domains that are still online.

I confirm that I have received the payment and I can only say that I am glad that we prevented some bad people from cheating other people. I have no doubt that we will take down the remaining domains - we just need time and patience.

[roosbit]

Didn't understand this message, but did support try to say that they were closed for the Easter holiday?


Nic.cy reply I got .

CONFIDENTIAL
 
Good morning,
 
Please report it to

https://cybercrime.police.gov.cy/police/CyberCrime.nsf/subscribe_en/subscribe_en?openform,

Email:
cybercrime@police.gov.cy
 
And to
www.csirt.cy

[Pmalek]

I can confirm that both monero[.]forex and darknetbible both removed eXch phising links from their domains. Could be a temporary move or not.

I noticed it a few days ago. They are no longer pointing to phishing sites of eXch but they are still advertising phishing websites of other exchanges. Not much has changed. Both sites remain malicious and can cause people to lose their money. Their decision to remove the eXch phishing domains could be just a trick to stop the reports with the goal to resume advertising the mentioned phishing sites in the near future.

[NotATether]

I just noticed that monero[.]forex just removed Exch from their website


https://monero.forex/anonymous-crypto-exchanges/

Recommending ChangeNOW is still terrible though. Like don't they know about their shadow-confiscation?

[Mpamaegbu]

The rewards have been distributed for the 4 domains that are already suspended.

TXID: 61792cf9a1cdedf9b0d4bc676741dcf3ba8c85ecfcab83e64e2a626d67b1d617

We thank you for the work done, and we encourage you to continue the good work for the domains that are still online.

I confirm that I've received reward. Thanks. That's very generous of you. We will continue to follow up on those phishers.

[Ambatman]

We thank you for the work done, and we encourage you to continue the good work for the domains that are still online.

Thanks exch. Reward received. Your generosity was present.

Their decision to remove the eXch phishing domains could be just a trick to stop the reports with the goal to resume advertising the mentioned phishing sites in the near future.

The issue I have is the fact that they had to present removing a phishing site because exch is shutting down.
I don't really see them continuing promoting exch in the nearest future except I'm not getting your words well
Exch customers would be informed about the shutting down
So I think they would just find another platform after leaving exch.

[Haunebu]

Both monero.forex and darknetbible.info only stopped linking to exch.best(phishing domain of exch.net) because of a combo of exch shutting down announcement and exch.best getting blacklisted and not because of the registrar if you ask me. Good turn of events whatever the case.