[OPEN] eXch Anti-Phishing Campaign

[SamReomo]

Reported all of those phishing domain names and hope they'll all go down soon. I truly support and appreciate eXch approach to combat those phishing sites and I hope that most of those scam and phishing domains will do down very soon.

[DubemIfedigbo001]

I will be participating too

My bitcoin address
bc1q500rp4r47w3tvds9syq7klx0ckw645m2gqc9cu

[FP91G]

So far, responses have been received from the addressees:

domainabuse@tucows.com, abuse@namecheap.com,donotreply@publicdomainregistry.com

Btc address: bc1qyn0mdf3tkrcaueepmqjcdtc3p3hjdlv9g280ac

[Mpamaegbu]

I assume everyone who reported got an email too.

Yes, I got that email too. However, I didn't fill the complaint form. I emailed the cybercrime@police.gov.cy instead.

[GazetaBitcoin]

With two everything went well but report that had to be sent to web.com is not working, because submit report button is not working.

In my case it worked. But try to report by email -- abuse@web.com.

Received

What did you receive?

I'm sending from Protonmail.  Does anyone else have similar problem?

Yes, I encountered the same problem... I mentioned it here.


On an additional note, after reporting exch[.]cc using the link https://www.newfold.com/abuse, I received this weird email, from the address noreply@support.networksolutions.com:

We are writing in response to your recent complaint concerning the domain name .

We understand that you find the content on the website associated with this domain name abusive, offensive, or otherwise objectionable; however, neither Web.com nor its subsidiary registrar brands (collectively, “Web.com”) are the registrant of the domain name, nor providing hosting services for the domain name. Web.com is simply the registrar of record, providing domain registration services. As such, we are also not in a position to determine whether a particular domain name registration violates a third party's rights.  

Based on available information on a public WHOIS lookup, the domain is current hosted by Global-Data System IT Corporation.

Web.com will only take action with respect to a particular domain registration pursuant to (i) a request from the current domain name registrant; (ii) the terms of the Uniform Domain Name Dispute Resolution Policy (“UDRP”) issued by the Internet Corporation for Assigned Names and Numbers (“ICANN”), the international regulatory body that oversees the administration of domain names; or (iii) an order from a court or arbitral tribunal of competent jurisdiction.

If you would like to file a domain dispute against the registrant of the domain, please visit the following link for more information:

https://www.icann.org/resources/pages/dispute-resolution-2012-02-25-en

Please note that under the U.S. Communications and Decency Act, an Internet Service Provider or Web host is immune from liability for the content posted on a website by a customer, and therefore, neither Web.com nor its affiliates would be a party to any potential court, arbitral or regulatory proceedings.

We consider the matter closed.

To ensure we can continue assisting you, please respond to this email within 72 hours with any further details or updates on your issue. Your ticket will be closed automatically if we do not receive a response within this timeframe.

In the event that 72 hours have passed, please visit https://newfold.com/abuse to resubmit your case with additional details.

Furthermore, I tried to reply to that email by asking if they are indeed the ones to whom I should report exch[.]cc, because in their email they said, "To ensure we can continue assisting you, please respond to this email within 72 hours with any further details or updates on your issue.". However, when I tried to reply I received this pop-up window saying "The email address noreply@support.networksolutions.com does not seem to accept replies. Are you sure you want to send your message?". I sent the email anyway and immediately I got another email, from MAILER-DAEMON@proton.me, saying

Hello,

Your message was not delivered to one or more recipients. Please check the destination email addresses and errors shown below before retrying.

Recipient(s): noreply@support.networksolutions.com

Error: Rejected by spam filter

Subject: Re: Network Solutions Customer Support [ABU-32248]

Time sent: Mon, 17 Mar 2025 19:23:45 +0000

Thank you,

The Proton Team

This is very strange...

[Medusah]

@eXch Support, are you sure that exch[.]cc is registered under web.com?  I got this email from support@web.com (which should be sent to you as well, because I added you as CC):

Dear Parties,
 
Thank you for contacting us. However, we wish to inform you that, to the best of our knowledge, we are not providing services related to the website. Please inform us if you believe we are mistaken, including details on why you believe we provide the services at issue, and we will be pleased to review the claim promptly.

Currently, it appears that the hosting provider for this website is:     Global-Data System IT Corporation

To ensure we can continue assisting you, please respond to this email within 72 hours with any further details or updates on your issue. Your ticket will be closed automatically if we do not receive a response within this timeframe.

In the event that 72 hours have passed, please visit https://newfold.com/abuse to resubmit your case with additional details.


Thank you,
Abuse Specialist

I went to check the domain name registrar from WHOIS, and it seems that it is networksolutions.com instead:  https://who.is/whois/exch.cc.  I think we should contact Network Solutions instead.  (From newfold.com/abuse, instead of Web.com, pick NetworkSolutions.com)

But, let me know just to be sure.


I have also emailed cybercrime@police.gov.cy for exch[.]cy.

[GazetaBitcoin]

I think we should contact Network Solutions instead.  (From newfold.com/abuse, instead of Web.com, pick NetworkSolutions.com)

Thanks, I hope this works.

Meanwhile we have a first win, as exch[.]center was taken down hooray! I just received this email:

From: abuse@publicdomainregistry.com
Subject: Reporting phishing / impersonating domain - Case #: 50895058

Thank you for contacting us. Please note that the reported domain name has already been placed under ClientHold.


With this suspension, all associated services on the domain name cease to function.


Please note that the clientHold status will be maintained until the malicious content is removed from the website.


Do let us know if you have any queries.


Regards,  
Abuse Mitigation Team  
PublicDomainRegistry

[examplens]

I was only able to view 1 site darknetbible[.] info and there's no mention of the eXch service. Perhaps the scammers have already taken action.

see on the page.

Code:

https://darknetbible.info/bible/cryptocurrencies/converting/

see on the page. Most likely, the same people are behind these two domains; monero[.]forex and darknetbible[.] info since there are links between these pages.

[apogio]

I was only able to view 1 site darknetbible[.] info and there's no mention of the eXch service. Perhaps the scammers have already taken action.

see on the page.

Code:

https://darknetbible.info/bible/cryptocurrencies/converting/

see on the page. Most likely, the same people are behind these two domains; monero[.]forex and darknetbible[.] info since there are links between these pages.

There is also a link to exch[.]cash in there. Did you spot it? If you click the red text (obviously I removed the links) it guides you to exch[.]cash

Non-KYC Crypto Exchanges

There are a few different places you can find link aggregators for services that will convert your coins, without requiring personal informations. The two most widly used services are XChange and eXch. They are both highly recommended, widely trusted, and have low fees. Monero.Forex maintains an up-to-date list of Non-KYC Exchanges that list Monero. You can also visit our sister XMR guide that has a list.

Note XMR should always be your first option. If this is not an option Litecoin is a good starting coin. Remember both bitcoin and Litecoin are easily traced, but Litecoin has lower fees.

[examplens]

There is also a link to exch[.]cash in there. Did you spot it? If you click the red text (obviously I removed the links) it guides you to exch[.]cash

Yes of course. I sent a screenshot with that information to Namecheap.
I sincerely hope that they will react in some reasonable time. Especially if a large number of us respond to this campaign.

[bitmover]

I was only able to view 1 site darknetbible[.] info and there's no mention of the eXch service. Perhaps the scammers have already taken action.

see on the page.

Code:

https://darknetbible.info/bible/cryptocurrencies/converting/

see on the page. Most likely, the same people are behind these two domains; monero[.]forex and darknetbible[.] info since there are links between these pages.

Darknetbible points to monero[.]forex which points to exch[.]cash

Maybe it will be harder to remove those 2, as they are not plagiarized websites like .cash

[Cricktor]

I reported from a protonmail.com email address that I barely use to send emails, so I would be very surprised if this email address got flagged for spamming. I always added support@exch.cx in BCC.

abuse@web.com, support@nic.cd responded with

Error: Rejected by spam filter

Lame excuse to refuse to process valid complaints...


Namecheap web form to report abuse at least got me this:

[NC-NVE-9528] Reporting domain that links to phishing websites

Not sure if this is a valid case id...


No response yet from complains@nic.cy and domains@nic.cy --- I take it as a positive that they didn't reject it as spam.

Abuse report to tucows is also out, I edited their confirmation email with case id in my campaign onboarding post on first page.

[examplens]

Maybe it will be harder to remove those 2, as they are not plagiarized websites like .cash

I think they will first get a warning to remove suspicious links. If they don't do that, there will be a temporary suspension and later a permanent one. If they remove all disputed links, the domain will remain unchanged.
However, if this is resolved with this campaign, over time it will be necessary to monitor what they are doing. Of course, the suspension of the phishing sites they promote would be of great help. It is certainly much more complicated to follow such linked sites.

[DYING_S0UL]

I am joining too.

BTC address: bc1qce3ddrsccvm8efjfaes22glaef6ruhhn4a2y8n

Edit 1: all reports are sent and got a generic response from Namecheap.

• Case 1: [NC-SFE-6596]
• Case 2: [NC-BWT-1319]

Edit 2: got a reply from Tucows.

• A request (5469282) has been created.

Edit 3: got a response from bluehost but not sure how I ended up with this as I remember I didn't sent any email to anyone called bluehost. Maybe it's affiliated with other hosting companies.

• Bluehost Customer Support [ABU-32735]

This was their response,

Dear,
Thank you for reporting to us. I'm Alisha from the Compliance Department looking into your abuse report.
It appears the owner of the domain is using the reverse proxy service provider, Cloudflare, to mask the true IP address of the website. This means we cannot accurately determine the true host of the site and must recommend that you contact Cloudflare first. Cloudflare will redirect your complaint to the current hosting provider so that it can be addressed accordingly.
To ensure the prompt processing of your abuse report we request that you please submit your abuse report through Cloudflare's abuse reporting web form at: https://www.cloudflare.com/abuse/.
Should you have any other questions please feel free to contact us again.

Regards,
Alisha S
Escalated Support

Waiting for others to reply. Fingers crossed.

[xOrpian]

I just checked the mail from Network Solutions. We may see another one down soon, likely within 48 hours.

Edit: The strange part is, I didn't send any emails to 'Network Solutions'
The Domain exch[.]cc -/- is Down.

I went to check the domain name registrar from WHOIS, and it seems that it is networksolutions.com instead:  https://who.is/whois/exch.cc. I think we should contact Network Solutions instead. (From newfold.com/abuse, instead of Web.com, pick NetworkSolutions.com)

But, let me know just to be sure.

If you send an email to 'Web.com' or 'newfold.com/abuse', the domain will still be taken down.
I never mailed to NetworkSolutions in my case, but I still got a response from them, it seems they process information on phishing websites together.

As of now, exch[.]cc is not accessible.

That was quick.

[Adams0001]

I will be participating too.

BTC address:
bc1qmwness6eq6kd68z26rjwmdv67sarg7mwg80p3w

[xLays]

As of now, exch[.]cc is not accessible.

[BenCodie]

Nice work on the first take downs everyone   I just might recover what I lost from exch.cc with the win here, very happy (and lucky!) with this campaign!

I reported all of the other domains, though this one is the one I got a response for. I guess all of the others got inundated and didn't reply to everyone 

[Medusah]

As of now, exch[.]cc is not accessible.

That's good news.  That domain name was the worst possible for an attacker to own, since it was officially owned by eXch in the past. 

[Odohu]

I will be reporting all the phishing websites asap.

Here is my BTC address: bc1qd666kg8m9p9mcw9e40pf0nhv9gvnjv5r3j05mc