[OPEN] eXch Anti-Phishing Campaign

[eXch Support]

Some have done good reports but have not communicated their username, they can still contact us via PM if necessary.

Following our last post, we received numerous PMs.

We confirm that we will answer to everyone in the coming days, we need time to do the necessary checks.

[examplens]

What approach are you thinking of taking now, with these events and movements in the last few days?

Well..

As Namecheap is no longer responsible for these domains, the previous site namecheapscamexpose.info no longer has sufficient weight.
That's why a new, slightly more general domain is coming.

CryptoFraudExpose.org

There are some new updates, at least those known to me. (If there's anything I missed, feel free to mention me)

With threats to me, the whole case went much further. That's why I sent a more formal report to both registrars, and I expect an official response from them. This correspondence may be submitted as part of an official legal complaint or included in reports to relevant authorities.

[rolypoly]

Some have done good reports but have not communicated their username, they can still contact us via PM if necessary.

Following our last post, we received numerous PMs.

We confirm that we will answer to everyone in the coming days, we need time to do the necessary checks.

I can understand how people could have missed this. Personally, I didn’t see the email on time because I receive a lot of emails daily and was relying on the first post in this thread for any important updates. I’m not blaming you, but if the original post had been updated to ask us to email you our usernames, the situation might have been avoided.

[Haunebu]

I’m not blaming you, but if the original post had been updated to ask us to email you our usernames, the situation might have been avoided.

That could have helped for sure, but it wasn't really necessary since @eXch Support provided multiple warnings. If y'all weren't willing to check the latest posts in this thread, that's just proper laziness frankly speaking.

[God Of Thunder]

@eXch Support,

I received two emails as a reply, one from complains@nic.cy and another from domains@nic.cy
Both contain the same email.

[joker_josue]

What approach are you thinking of taking now, with these events and movements in the last few days?

Well..

As Namecheap is no longer responsible for these domains, the previous site namecheapscamexpose.info no longer has sufficient weight.
That's why a new, slightly more general domain is coming.

CryptoFraudExpose.org

There are some new updates, at least those known to me. (If there's anything I missed, feel free to mention me)

With threats to me, the whole case went much further. That's why I sent a more formal report to both registrars, and I expect an official response from them. This correspondence may be submitted as part of an official legal complaint or included in reports to relevant authorities.

I think that creating a more generic domain to expose the case is better. It opens the door to expose more similar cases, regardless of the provider.

Since he removed the links to the fake eXch, you can point to the other fake domain he is exposing xchange[dot]cx. Perhaps this will help highlight that the scheme continued, albeit using a different front.

Here we are clearly faced with a phishing site.
The xchange[dot]cx website is clearly copying the official xchange.me website.

Below are links that may help prove that both domains are not related.
https://whoisfreaks.com/tools/whois/history/lookup/xchange.cx - Copy/phishing site. Registered later and with another NS.
https://whoisfreaks.com/tools/whois/history/lookup/xchange.me - Genuine site, with older registration and correct Name Server.

[roosbit]

The scammer smartly moved from a bad registrar(Namecheap) to a very bad registrar(1api gmbh). Namecheap atleast communicated regularly, but 1api and EasyDNS don't bother replying at all. They are just as useless as exch.cd and exch.cy registrars.

No update from exchange support on the two domains that removed the phishing affiliate links form their websites?

From my end , I think they no longer have a case with exchange.net

And the last two {exch.cd and exch.cy} the registrars don't just care about these report's we flooding them with.

[Haunebu]

And the last two {exch.cd and exch.cy} the registrars don't just care about these report's we flooding them with.

Yeah. This is why I mentioned earlier that blacklisting is the best course of action against the remaining phishing domains since the chances of either of them getting suspended are extremely low.

[bitmover]

I tired a different approach

I have called easydns on twitter

https://x.com/bitmover2/status/1915051014685933568

Lets make some pressure

I got a reply from easydns here
https://x.com/easyDNS/status/1915453400822464986

I just answered them, with @examplens page:
https://x.com/bitmover2/status/1915455563233718493

[Cricktor]

And the last two {exch.cd and exch.cy} the registrars don't just care about these report's we flooding them with.

IIRC, I filed a complain at ICANN for one of the non-compliant registrars (I think it was namecheap in that case). As far as I see it, registrars who fail to act against phishing domains they registered brake rules they should comply with ICANN. So far ICANN isn't particularly responsive, but with better evidence presentation they might listen and put pressure on those non-compliant domain registrars.

It may help if more people also complain with substantial evidence to ICANN for those pesky registrars.


Many thanks to examplens for

CryptoFraudExpose.org

because I assume it helps a lot to present as much evidence as possible for complain reports!

[zasad@]

@eXch Support,

..

I have the same letter, and I think others have the same.
To write a statement to the police, you need to provide personal data, so you need to look for other ways.

[bitmover]

Hey @eXch Support, Darknetbible was just nuked down by easydns. They replied to us on X!!!

https://x.com/easyDNS/status/1915560482573873270

[PX-Z]

Hey @eXch Support, Darknetbible was just nuked down by easydns. They replied to us on X!!!

https://x.com/easyDNS/status/1915560482573873270

That's good news. I tried to access the site and its probably shutdown. That's why just recently those scammers and co-spammers on X (Twitter) are in raged with threatening posts. Lol

Highly likely they will create new domain to replicate the site and just like that, repeat the report process.

[Cricktor]

Hey @eXch Support, Darknetbible was just nuked down by easydns. They replied to us on X!!!

Well done, finally! This is how it looks now:

[DubemIfedigbo001]

I can confirm now that easy DNS has brought down darknetbible.info, seems we won them for now. Kudos to team bitcointalk.

[Haunebu]

Learnt that Centralnic owns 1api.net which is why it would be better to send our phishing report regarding monero.forex to them. Already sent mine and am sharing their contact details.

https://centralnicregistry.com/contact/?subject=general
abuse@centralnic.com

@eXch Support should update these details in the op.

https://x.com/easyDNS/status/1915560482573873270

Great stuff! Am surprised by this to be honest. Good to see one more phishing domain going down, but monero.forex is the big fish in comparison and it will take something else to take that site down.

[DYING_S0UL]

Hey @eXch Support, Darknetbible was just nuked down by easydns. They replied to us on X!!!

Well done, finally! This is how it looks now:

While you guys are getting the message from easydns I am getting CONNECTION REFUSED! So it is down, right? Looks like the collective hard work by everyone finally paid off!

[PX-Z]

While you guys are getting the message from easydns I am getting CONNECTION REFUSED! So it is down, right?

Make sure to use "http://" instead of "https://" so it redirects properly to the EasyDNS shutdown error page. And yep, it’s now officially taken down by its registrar after hopping over to EasyDNS from namecheap, which basically ended up being its final resting place. lol

[DYING_S0UL]

While you guys are getting the message from easydns I am getting CONNECTION REFUSED! So it is down, right?

Make sure to use "http://" instead of "https://" so it redirects properly to the EasyDNS shutdown error page. And yep, it’s now officially taken down by its registrar after hopping over to EasyDNS from namecheap, which basically ended up being its final resting place. lol

Yup, after changing the protocol I'm able to see the easydns message!

Now the only remaining phishing domains/redirecting phishing are these three!

• monero[.]forex
• exch[.]cd
• exch[.]cy

Can anyone confirm the latest situation?

1. The first site is accessible from my side.

2. I am getting a Dangerous site warning from the 2nd site (got flagged by google for phishing).
https://transparencyreport.google.com/safe-browsing/search?url=https:%2F%2Fexch.cd%2F&hl=en

3. I am unable to access the third site!

1.
2.
3.

[BeerJoe]

Now the only remaining phishing domains are these three!

• monero[.]forex
• exch[.]cd
• exch[.]cy

Is it allowed to engage extra pair of hands from tor sites to nuke these sites.