[OPEN] eXch Anti-Phishing Campaign

[PX-Z]

Now the only remaining phishing domains/redirecting phishing are these three!

• monero[.]forex
• exch[.]cd
• exch[.]cy

Confirmed,  both the .cd and .cy domains are now taken down. As for monero[.]forex, it might not matter much anymore, but since the reports are already ongoing, it makes sense to see it through. I just re-reported it as well using "Xchange" and "eXch" from the archived pages. Let’s wrap this up properly. 💪

[DYING_S0UL]

Now the only remaining phishing domains/redirecting phishing are these three!

• monero[.]forex
• exch[.]cd
• exch[.]cy

Confirmed,  both the .cd and .cy domains are now taken down. As for monero[.]forex, it might not matter much anymore, but since the reports are already ongoing, it makes sense to see it through. I just re-reported it as well using "Xchange" and "eXch" from the archived pages. Let’s wrap this up properly. 💪

This is called the power of Unity !

Bitcoin community 1
Scammers 0

Btw, I also re-reported those two .cd & .cy domains, even though the supports didn't respond properly they surely took steps, I guess.

Regarding monero site, are they still redirecting phishing? I though they had removed the fake link. The "Xchange" is also fake?

[BeerJoe]

( exch.cd )not fully taken down. Just gives warning but you can still see it after the dangerous message.

[Haunebu]

Was surprised to see darknetbible.info go down and am a lot more surprised to see exch.cy go down. Superb stuff Bitcointalk team. Only 2 remaining now(Monero.forex and Exch.cd(Blacklisted)). We are almost at the finish line.

[Pmalek]

darknetbible[.]info and exch[.]cy   are down.
The two that remain are monero[.]forex and exch[.]cd.
exch[.]cd isn't down. The site has a Google Safe Browsing notification attacked to it.

I think we can use easyDNS' takedown of darknetbible[.]info as a means to bring down the phishing site monero[.]forex. They are very similar. Both point to phishing sites xchange[.]cx and stealthex[.]co. Additionally, darknetbible[.]info links to monero[.]forex, which is again proof of their connection.

You can see that here:
https://web.archive.org/web/20250402103252/https://darknetbible.info/bible/cryptocurrencies/converting/index.html

Here are additional contact emails associated with .forex domains that we can send our complaints to:
https://www.iana.org/domains/root/db/forex.html

In your reports, mention how darknetbible[.]info tries to trick people into visiting xchange[.]cx and stealthex[.]co where they will lose their money because those are phishing websites. Mention how easyDNS proved they were phishing websites by depositing money with a test transaction and getting scammed.

Here is the proof of that: https://x.com/easyDNS/status/1915560482573873270

Finally, ask the registrar to do its job and shutdown the phishing site it's providing services to.

[Woodie]

Seeing this photo here reminds me of "Pirates of the Caribbean: Dead Men Tell No Tales" unfortunately in this story it's end of the road for darknetbible all thanks to namecheap failing to do their job not until domain was transferred and easyDNS pounced on them!!

GG #easyDNS.

Btw why do I feel twitter could be doing more damage, as in it's more effective to get a review from these guy's from there... because emails seem to be getting generic responses imo.


Almost forgot, why do takedowns happen on the 25th

[joker_josue]

I tired a different approach

I have called easydns on twitter

https://x.com/bitmover2/status/1915051014685933568

Lets make some pressure

CryptoFraudExpose.org

There are some new updates, at least those known to me. (If there's anything I missed, feel free to mention me)

I think this combination, in the approach, helped in the decision making.
Sometimes when domains are registered by "smaller" companies it helps, as they have more time to analyze the cases in more detail.


In the case of monero[.]forex I think the approach now has to be to the other phishing site that they are indicating: xchange[.]cx

@examplens you should include this on your website.
I think we have entered a phase where we cannot concentrate information around eXch, we have to approach the subject in a more comprehensive way.

[Woodie]

In the case of monero[.]forex I think the approach now has to be to the other phishing site that they are indicating: xchange[.]cx

@examplens you should include this on your website.
I think we have entered a phase where we cannot concentrate information around eXch, we have to approach the subject in a more comprehensive way.

That's why I did mention last time out that we needed other companies that are being defrauded/cloned to get into this fight...as mentioning exch is being phished now is inaccurate.

For takedown to happen, other websites being phished has to be mentioned.


@exch support

If you are on twitter, something to consider as advised by easyDNS.



Am sure not a free service but anything that will help should be given a listening ear👂


Just an after thought,if easyDNS could understand what was happening with darknetbible, can we have them explain this to namecheap for easy understanding??

[Blossom15]

Count me in:

bc1qxgf0phx8d6dahrhwk9zun7cqpvawa26fpeq4vw

[easydns]

We don't roll SSL/TLS certs for nuked domains.

So http:// only.

Site is down - you can always look at the nameservers as well:

Name Server: fraud.easydns.wtf
Name Server: terminated.easydns.wtf

[SamReomo]

darknetbible[.]info and exch[.]cy   are down.
The two that remain are monero[.]forex and exch[.]cd.

That's a great news I was sure that those domains will also go down and fortunately two of those are down and the rest of the two will also have same fate that's my firm belief. I've a plan for those remaining domains that aren't suspended yet. We all should report those domains again and during this report we should mention all of the domains that we reported which are suspended and who knows after knowing that these domain registerers might also consider shutting those two domains down. There's high chance of success I believe, what do you guys think?

[bitmover]

I think newbie accounts shouldn't be accepted.

These can be alts of the same person.

Just my suggestion , @exch support.

[easydns]

If some good soul would compile a list of all the fake exch.net domains and list them one per line we could add them to the Domainsure Crypto Defender threat feed:

https://domainsure.com/rpz-threat-feeds/

That gets pushed out to resolver services (like Quad9) which can dampen the reach of known phishing domains before they get taken down.

[Haunebu]

If some good soul would compile a list of all the fake exch.net domains and list them one per line we could add them to the Domainsure Crypto Defender threat feed:

Currently, we are focused on taking down 2 specific phishing domains of exch.net that I have listed below.

- https://www.monero.forex
- https://www.exch.cd

[SamReomo]

I've sent this e-mail to the registrar of Monero.Forex and eXch.cd hope the registrars might consider suspending the domain names after reading this mails.








I request everyone to send them the same e-mail or something similar so they might take action against those domains. That'll be 100% success for this campaign!

[Sekhmet_]

If some good soul would compile a list of all the fake exch.net domains and list them one per line we could add them to the Domainsure Crypto Defender threat feed:

https://domainsure.com/rpz-threat-feeds/

That gets pushed out to resolver services (like Quad9) which can dampen the reach of known phishing domains before they get taken down.

Code:

https://exch.ac/
https://exch.cd/
https://excz.cx/
https://exclh.cx/  
https://excn.cx/
https://excj.cx/
https://exsch.cx/
https://exch.exchange/

[Woodie]

Code:

https://exch.ac/
https://exch.cd/
https://excz.cx/
https://exclh.cx/  
https://excn.cx/
https://excj.cx/
https://exsch.cx/
https://exch.exchange/

Am now lost, what are all these domains for 

[Cricktor]

Learnt that Centralnic owns 1api.net which is why it would be better to send our phishing report regarding monero.forex to them. Already sent mine and am sharing their contact details.

https://centralnicregistry.com/contact/?subject=general
abuse@centralnic.com

Can you share this evidence that Centralnic owns 1api.net? I seem to fail to find such information.

Both appear to be under the roof of teaminternet.com but that doesn't imply Centralnic owns 1api.net.

Am now lost, what are all these domains for 

See here only a few posts back:

If some good soul would compile a list of all the fake exch.net domains and list them one per line we could add them to the Domainsure Crypto Defender threat feed:

https://domainsure.com/rpz-threat-feeds/

That gets pushed out to resolver services (like Quad9) which can dampen the reach of known phishing domains before they get taken down.

[SamReomo]

Got this automated reply from them, hope they might take some action against the domain name.

[Woodie]

Am now lost, what are all these domains for  

See here only a few posts back:

If some good soul would compile a list of all the fake exch.net domains and list them one per line we could add them to the Domainsure Crypto Defender threat feed:

https://domainsure.com/rpz-threat-feeds/

That gets pushed out to resolver services (like Quad9) which can dampen the reach of known phishing domains before they get taken down.

fake exch.net domains.... Meaning phishing sites??

Are we saying besides "exch[.]cd"from that list, are we confirming the rest are clones and phishing sites too ??

Have you tried opening any of those domains? I have and they are either for sell or not pointing to anything which is why I raised my question ❓

Btw, Without dragging any names into this, how do we verify easyDNS are who they say they are on the forum...tried asking to verify this account on twitter(X),  haven't got a reply from them yet