[OPEN] eXch Anti-Phishing Campaign

[Pmalek]

<Snip>

It wouldn't hurt to report those phishing websites that monero(.)forex and darknetbible direct users to. That way if they replace them with other links, it's a clear sign that they are only doing that to point people to new phishing sites.

I am sure we would all like to hear something new from the eXch team as they have been quiet for quite some time now.

[Hyphen(-)]

https://darknetbible(.)info/bible/cryptocurrencies/converting/ working
https://xchange(.)cx/  not working

I think it has been updated already that the domain has been suspended since 25/04/2025. The only two active domains are monero(.)forex and exch(.)cd and many reports has been submitted we are expecting the two domains to be suspended soon.

[joker_josue]

<Snip>

It wouldn't hurt to report those phishing websites that monero(.)forex and darknetbible direct users to. That way if they replace them with other links, it's a clear sign that they are only doing that to point people to new phishing sites.

It is and it isn't. Because they can claim that they were also deceived. The process has to be repeated many times, to create suspicion. But in the meantime, they switch to another domain registrar and the investigation starts all over again.

I'm not saying that people shouldn't continue to report, whether or not there is support from eXch. What I'm saying is that the model of these two sites will always make reporting difficult, as it will always be superficial.

We don't need to be discouraged, I think we have already achieved a lot and we have to be proud.

[SamReomo]

I have some questions to eXch team:

Now the operations of eXch are totally shut down then how it would be possible for us to take those phishing sites down?

Although, we're still trying our best but from nic.cd and such domain registrars it's hard to get any positive response and we also can't prove to them anything in detail now since the operations of eXch are down.

I personally believe this campaign was fully a successful one but without taking down that .cd domain name and now that monero.forex, it's hard to say anything as of now.

So eXch team at this point what should be do? I mean is it going to be worth it to report the sites while eXch is now totally down?

[NotATether]

Prepaid burner phones or prepaid SIM cards aren't avalaible officially without KYC <cut>

Seriously? You can no longer buy a prepaid SIM card or a burner phone without KYC in Germany? That's a shame. I didn't know that. Here in Croatia, you can still walk into a Tisak (newsstand) or a Tele2 shop and grab a prepaid SIM with no questions asked.

And here I was thinking that you can only get one like that in the US and UK.

No SIMs here without KYC either. (I won't state the country so the TempleOS-namesake nutjob doesn't get the hint, but it's really not that hard if you do a few forum searches   )

But roaming is expensive, so here I am with a local SIM.

I'm more surprised that people aren't entirely on eSIMs yet.

[bitmover]

I'm more surprised that people aren't entirely on eSIMs yet.

People need to buy new phones for that.

I just got a new phone a few months ago. before that my phone didn`t support eSIM. This is the situation of many people, specially in emerging countries where phones are more expensive.

And my new phone has literally just one new feature, which is the eSIM. I wouldn`t have changed it, but my old phone felt and the screen broke

[Pmalek]

I think it has been updated already that the domain has been suspended since 25/04/2025. The only two active domains are monero(.)forex and exch(.)cd and many reports has been submitted we are expecting the two domains to be suspended soon.

darknetbible was initially suspended but the site is back online. Feel free to check it yourself. There is no reason to speculate.

[Haunebu]

I am sure we would all like to hear something new from the eXch team as they have been quiet for quite some time now.

Yeah. I observed that too since their last post in this forum was around 10 days ago. @eXch Support need to be a bit more active in this thread by providing updates regularly like before.

[Woodie]

To try to be more efficient, we have to go after these two domains:
xchange[.]cx
stealthex[.]co

They are the new element of the scheme, and for that they have to be overthrown.

Totally agree 💯

We now have to put out the dirty laundry for companies that haven't even shown interest in this fight or don't know what's happening to their brand out there , Ouch

Besides, considering these phishing sites removed eXch from their phishing farm, the only possible case we can pin them down for is xchange[.]cx or stealthex[.]co . The reporting method has to change going forward as exch being phished is out of the equation, the companies being phished should be what's to be used now.


Btw for exch[.]cd , if we are to put more pressure on the registrar on top of those old reports made, is the approach supposed to be the same with exch.net gone ?

[FP91G]

https://centralnicregistry.com/
Registrar Abuse Contact Email: email@key-systems.net
https://www.whois.com/whois/xchange.cx

Registrar URL: www.opensrs.com
Registrar Abuse Contact Email: email@tucows.com
https://www.whois.com/whois/stealthex.co


Maybe we can flood these services with complaints so that monero[.]forex removes the links

[albon]

https://centralnicregistry.com/
Registrar Abuse Contact Email: email@key-systems.net
https://www.whois.com/whois/xchange.cx

Maybe we can flood these services with complaints so that monero[.]forex removes the links

When I sent a message to the abuse email you provided, I received the following response:

Delivery has failed to these recipients or groups:

email@key-systems.net
A problem occurred while delivering your message to this email address. Try sending your message again.

So you can update the abuse email to the following instead:

https://centralnicregistry.com/
Registrar Abuse Contact Email: abuse@centralnic.com
Or use this page: https://centralnic.support/hc/en-gb/requests/new

Maybe we can flood these services with complaints so that monero[.]forex removes the links

I have already submitted complaints from my side and I hope the registrar will take action against the domain as soon as possible. I also encourage other members to do the same, to put more pressure on the domain registrars to investigate and take down the domains. This will force monero[.]forex to remove the domain as well.

[Pmalek]

Do others agree? Should the new approach be to include complaints to take down the phishing sites xchange(.)cx and stealthex(.)co as well?
These scammers from monero(.)forex and darketblible (intentionally misspelled) will then surely replace them with other phishing domains for the same exchanges.

[joker_josue]

Do others agree? Should the new approach be to include complaints to take down the phishing sites xchange(.)cx and stealthex(.)co as well?
These scammers from monero(.)forex and darketblible (intentionally misspelled) will then surely replace them with other phishing domains for the same exchanges.

It never hurts to report. Now it's time to see who has more patience.
It is to report all the phishing sites that come up. Or the creator of these sites gives up.

In an analysis I did, I suspect that there are about 7 sites associated with this scheme.
At least known we have 3 or 4. So this will take a lot of fighting...

[safar1980]

Delivery has failed to these recipients or groups:

Please send all abuse reports to abuse@centralnic.com or use the contact page. Please provide as much evidence as possible to assist in assessing your complaint.
https://centralnicregistry.com/policies/abuse/
response:
"Thank you for contacting us. Your request (329xxxx) has been received and is being reviewed by our support staff."

[TerryW]

I am sure we would all like to hear something new from the eXch team as they have been quiet for quite some time now.

Yeah. I observed that too since their last post in this forum was around 10 days ago. @eXch Support need to be a bit more active in this thread by providing updates regularly like before.

You people really are stupid as fuck. They used this thread and campaign for publicity, because they were banned from signature campaigns.

They have since been forced to shut down by law enforcement. You think they are going to keep coming back and paying you trolls to spam for them?

Do others agree? Should the new approach be to include complaints to take down the phishing sites xchange(.)cx and stealthex(.)co as well?
These scammers from monero(.)forex and darketblible (intentionally misspelled) will then surely replace them with other phishing domains for the same exchanges.

lol those sites redirect to affiliate links of real sites. Not phishing.

I guess if you were smart, you would not be spending your time begging for a few dollars here in exchange for spamming (mostly false) complaints.

[Doan9269]

I am sure we would all like to hear something new from the eXch team as they have been quiet for quite some time now.

Yeah. I observed that too since their last post in this forum was around 10 days ago. @eXch Support need to be a bit more active in this thread by providing updates regularly like before.

You people really are stupid as fuck. They used this thread and campaign for publicity, because they were banned from signature campaigns.

They have since been forced to shut down by law enforcement. You think they are going to keep coming back and paying you trolls to spam for them?

You're too harsh in your words, if they aren't trusted, they wouldn't have been here for the first time, paid everyone accordingly for the success in bringing down the fake domains already taken down, they may shut down, but they are still active with thier campaign from here until the remaining two domains left are also taken down.

[Hyphen(-)]

I think it has been updated already that the domain has been suspended since 25/04/2025. The only two active domains are monero(.)forex and exch(.)cd and many reports has been submitted we are expecting the two domains to be suspended soon.

darknetbible was initially suspended but the site is back online. Feel free to check it yourself. There is no reason to speculate.

I just checked the website now; it is back online. Maybe more reports need to be sent for further actions; maybe it will not take long to be suspended since it was taken down before.

[bitmover]

You people really are stupid as fuck. They used this thread and campaign for publicity, because they were banned from signature campaigns.

They were never banned from signature campaigns. Only mixers were banned.

Exchanges were never banned, and eXch is an exchange, not a mixer.

Looks like your business is suffering losses from this phishing campaign 

[albon]

Looks like your business is suffering losses from this phishing campaign 

His loud crying cracked me up> clearly, the campaign is paying off!

I topped off his negative trust to a nice even -10, hoping it soothes his nerves and eases the spasms caused by the reports that are about to wipe out his "source of income." 

I’ve added him to my ignore list > these fools exist only to disrupt and silence others so their scammy schemes can survive. But they won’t last long against this patient community.

[zasad@]

Delivery has failed to these recipients or groups:

Please send all abuse reports to abuse@centralnic.com or use the contact page. Please provide as much evidence as possible to assist in assessing your complaint.
https://centralnicregistry.com/policies/abuse/
response:
"Thank you for contacting us. Your request (329xxxx) has been received and is being reviewed by our support staff."

I also sent a report to this address and received a response with a report number.

I have already sent a report to this address and the manager answered me. Send reports to this address, the more there are, the more attention the company will pay to this site.