[OPEN] eXch Anti-Phishing Campaign

[xOrpian]

I went to check the domain name registrar from WHOIS, and it seems that it is networksolutions.com instead:  https://who.is/whois/exch.cc.  I think we should contact Network Solutions instead.  (From newfold.com/abuse, instead of Web.com, pick NetworkSolutions.com)

But, let me know just to be sure.

If you send an email to 'Web.com' or 'newfold.com/abuse', the domain will still be taken down.
I never mailed to NetworkSolutions in my case, but I still got a response from them, it seems they process information on phishing websites together.

As of now, exch[.]cc is not accessible.

That was quick.

[Odogwu-Blockchain]

I am joining this campaign to stop this impersonation.

BTC address:  bc1q8rckg53s2stej2n8ccgkj9q5apwhpyd0mlm8z2




Edit: All email sent and reported, I hope these domains get destroyed.

[goldkingcoiner]

BTC address:  bc1qmfr8egrks40cm54ctpy35lr8w43e0tdg6vmf9n

[Nalain420]

BTC address: bc1q2zljfzmv8vqft60wvplda57wndr9at76ufp3c5

[FleurTunisienne]

Great initiative, I would like to participate

BTC adress: bc1q22e2ss0h7va2r3ayk4y78nxrydpkuvsqx6ydpk

I reported all the mentioned websites from OP and sent proof to exch support. I hope all will be suspended.

[Moreno233]

Let's get to work and fight these scammers.

BTC Address: bc1qf7g6yhkxk236eesu37l427knyfjymjyaggxgdk

[ovcijisir]

With two everything went well but report that had to be sent to web.com is not working, because submit report button is not working.

In my case it worked. But try to report by email -- abuse@web.com.

~

First I reported this site on the e-mail address (abuse@web.com), but I got automated reply to report phishing issues on their web form. The reply from them is following:

Otherwise, if your complaint is regarding phishing, malware, botnets, pharming, spam (when used to deliver one of the previous issues) or any other form of abuse, please submit using our online reporting form https://newfold.com/abuse.

After that I tried to report issue on web form, but their submit report button was non responsive.

[justinlamode]

I am joining this campaign.

BTC address : bc1q7y3r8nmz9ruglkss6cnzn88cpf0vlr5ge5a9xr

[ovcijisir]

Today I finnished reporting the rest of websites that I had not reported yet.

Btw. I'm not sure how can exch connect our e-mail addresses with our BTC addresses? Not indicating anything, I'm just curious, I'd report scam websites even without reward.

Never mind, I found answer in post #16

[xOrpian]

I got a reply from Tucow's officer that they don't have the authority to change anything for domain 'exch[.]cash', so they asked me to send the mail to the Host of the '.cash' domain.

I've sent the report to 'IP Volume Inc'; after confirmation mail, I sent it to Tucows's officer, who told me they're also verifying the details to assist.



Another Domain should be going down soon.

[Felicity_Tide]

darknetbible[.]info

abuse@namecheap.com

I have made all the necessary reports against the list of active domains except for one, which I believe may have been shut down. Before submitting the report via email, I first checked all the domains except for the one mentioned above, as I couldn't access it.

Not sure though, but I would appreciate it if others could confirm whether the domain is still active so that I can report it as well.

BTC address: bc1qfgpkm3hwk3xv2ngflc4dkyzkjmv24d6jprhnud

[PX-Z]

darknetbible[.]info

abuse@namecheap.com

I have made all the necessary reports against the list of active domains except for one, which I believe may have been shut down. Before submitting the report via email, I first checked all the domains except for the one mentioned above, as I couldn't access it.

Not sure though, but I would appreciate it if others could confirm whether the domain is still active so that I can report it as well.

It’s still up. However, I didn’t report this domain along with the other one (monero[.]forex) because they don’t have the same look as exch to be considered as phishing, unless specific URLs is provided to be reported. Both sites appear more like blogs when accessed directly, so I didn’t report them at all.

[DYING_S0UL]

Five domains are still active and no real reply from abuse@namecheap.com, support@nic.cd, complains@nic.cy or domains@nic.cy whatsoever.

However, I got this response from tucows, and looks like they can't remove it, since they are not that position to do so.

After investigation we have found that Tucows only provides the registration for this domain.

We are not the webhost, internet service provider, or administrator for the reported domain. Given that we are not the webhost for the reported domain, the allegedly infringing material identified in your notification does not reside on Tucows servers. Accordingly, we do not have the technical ability to remove or disable specific items of objectionable content.

Again, due to the limited technical sphere in which Tucows operates, we do not believe that we are the correct party to contact regarding this matter.  In this instance, we suggest that you contact the party operating the website or the party hosting the website to have this matter properly resolved. A "ping" of the website you indicated often reveals the IP address of the party which probably hosts this website.  A "ping" of the website you indicated often reveals the IP address of the party which probably hosts this website. You may then use https://hostingchecker.com, https://search.arin.net/ or another similar tool to identify this party.

....snip

It’s still up. However, I didn’t report this domain along with the other one (monero[.]forex) because they don’t have the same look as exch to be considered as phishing, unless specific URLs is provided to be reported. Both sites appear more like blogs when accessed directly, so I didn’t report them at all.

However they redirects users to the phishing sites. Maybe we can modify our reports a little, explain the support that these blogging sites are being used as a channel for fake exchanges. And that they should immediately remove them to avoid any loses.

[Felicity_Tide]

It’s still up. However, I didn’t report this domain along with the other one (monero[.]forex) because they don’t have the same look as exch to be considered as phishing, unless specific URLs is provided to be reported. Both sites appear more like blogs when accessed directly, so I didn’t report them at all.

Thanks for the confirmation, but not sure of why I still can't access it from my end, even after using a different device.

It's true that the interface of the (monero[.]forex) looks different, which I had a hard time trying to figure out what to do at first, but after coming across the Disclaimer of the domain and the image below, I had to remodify my report to "an affiliate of a phishing domain".

[PX-Z]

However they redirects users to the phishing sites. Maybe we can modify our reports a little, explain the support that these blogging sites are being used as a channel for fake exchanges. And that they should immediately remove them to avoid any loses.

It's true that the interface of the (monero[.]forex) looks different, which I had a hard time trying to figure out what to do at first, but after coming across the Disclaimer of the domain and the image below, I had to remodify my report to "an affiliate of a phishing domain".

Yeah, I found reasons why it should be reported too. However, since it seems to be more of an affiliate site, reporting it as a phishing website might not be effective. Instead, reporting it to Google could help prevent these specific URLs/websites from appearing in search results when people look them up.

Thanks for the confirmation, but not sure of why I still can't access it from my end, even after using a different device.

How about trying different internet connection, wifi or data? or VPN?

[rolypoly]

BTC address:
bc1qsyv5x0ddghfwzty7hhxhh4kak9svg05e80ze92

[Kavelj22]

I have just received this reply from domains@nic.cy

Your complaint below has been forwarded to the competent authorities.

Please also submit your complaint at: https://cybercrime.police.gov.cy/police/CyberCrime.nsf/subscribe_en/subscribe_en?openform,

Email: cybercrime@police.gov.cy

What does this mean? Should we report this to the authorities as well? Aren't they the web hosts?

I will report the authority email mentioned in their reply. I don't know if i have to send proof to exch support email as well or no need for that.

[eXch Support]

Thanks to all those who made the necessary reports to achieve quick results, these two domains (.cc and .center) are now suspended. The rewards will be distributed accordingly after 1 month of suspension as stipulated in the rules in the first post. We will contact you by email in due time.

Domain: exch.cc
Registered On: 2024-12-30
Expires On: 2025-12-30
Updated On: 2025-03-18
Status:
client delete prohibited
client hold
client renew prohibited
client transfer prohibited
client update prohibited

Domain: exch.center
Registered On: 2025-02-02
Expires On: 2026-02-02
Updated On: 2025-03-17
Status:
client delete prohibited
client hold
client renew prohibited
client transfer prohibited
client update prohibited


About Tucows answers:

Five domains are still active and no real reply from abuse@namecheap.com, support@nic.cd, complains@nic.cy or domains@nic.cy whatsoever.

However, I got this response from tucows, and looks like they can't remove it, since they are not that position to do so.

After investigation we have found that Tucows only provides the registration for this domain.

We are not the webhost, internet service provider, or administrator for the reported domain. Given that we are not the webhost for the reported domain, the allegedly infringing material identified in your notification does not reside on Tucows servers. Accordingly, we do not have the technical ability to remove or disable specific items of objectionable content.

Again, due to the limited technical sphere in which Tucows operates, we do not believe that we are the correct party to contact regarding this matter.  In this instance, we suggest that you contact the party operating the website or the party hosting the website to have this matter properly resolved. A "ping" of the website you indicated often reveals the IP address of the party which probably hosts this website.  A "ping" of the website you indicated often reveals the IP address of the party which probably hosts this website. You may then use https://hostingchecker.com, https://search.arin.net/ or another similar tool to identify this party.

....snip

It’s still up. However, I didn’t report this domain along with the other one (monero[.]forex) because they don’t have the same look as exch to be considered as phishing, unless specific URLs is provided to be reported. Both sites appear more like blogs when accessed directly, so I didn’t report them at all.

However they redirects users to the phishing sites. Maybe we can modify our reports a little, explain the support that these blogging sites are being used as a channel for fake exchanges. And that they should immediately remove them to avoid any loses.

I guess I already reported some before, it was posted in eXch ANN thread. I will join this one again.

BTC address: bc1qwe09lhuvlpamhqqp7sfv9qtww68lyuydfp0ddn



Response I received from reporting exch[.]cash:

Hello;

After investigation we have found that Tucows only provides the registration for this domain.

We are not the webhost, internet service provider, or administrator for the reported domain. Given that we are not the webhost for the reported domain, the allegedly infringing material identified in your notification does not reside on Tucows servers. Accordingly, we do not have the technical ability to remove or disable specific items of objectionable content.

Again, due to the limited technical sphere in which Tucows operates, we do not believe that we are the correct party to contact regarding this matter.  In this instance, we suggest that you contact the party operating the website or the party hosting the website to have this matter properly resolved. A "ping" of the website you indicated often reveals the IP address of the party which probably hosts this website.  A "ping" of the website you indicated often reveals the IP address of the party which probably hosts this website. You may then use https://hostingchecker.com, https://search.arin.net/ or another similar tool to identify this party.

As per the implementation of GDPR, we are mandated to remain compliant with data privacy regulations. Therefore, we are no longer displaying whois information publicly and/or forwarding to the listed registrant. You can read more via the following link opensrs.com/the-gdpr/

However, you may contact the owner via the following link  

https://tucowsdomains.com/whois-search/ under registrant email

or via the corresponding registry's whois tool

If this is an issue of trademark, then you may want to review the documentation on how to lodge a formal dispute through the UDRP (www.icann.org/udrp) or a court of competent jurisdiction.


Essentially, we are an administrative body and do not judge or adjudicate issues of dispute.

If the domain does go to arbitration, please send any legal documentation (court filed or filed with an ICANN recognized arbitrator) by email to disputes@opensrs.org, fax 416-531-2516 attn: Disputes or by post to Tucows, Inc, 96 Mowat Ave, Toronto, Ontario, Canada M6K 3M1.


If you would like to find out the whois data, please send a separate email to tieredaccess@tucows.com to find out the process for obtaining whois data

Thank you again for your report, and please do not hesitate to contact us should you have any further questions.

Regards
* Compliance Officer * Tucows Inc/Ascio/Epag/Enom
https://www.tucowsdomains.com/compliance-form/
https://tucowsdomains.com/report-abuse/

A request (5471228) has been created. To add additional comments, reply to this email.

exch.cash is impersonating and phishing the official website https://exch.cx/

Thank you for your feedback. These are excuse emails because they seem to tolerate phishing, which is contrary to what they state on their website.
As registrars, it is their responsibility to act and do what is necessary to suspend the domain.

It is not right to redirect you to the hoster, that is not the goal. You can answer them that they are required to act, moreover they say it themselves on their website:

'In our corner of the world, there is rampant DNS Abuse (DNS Abuse refers to five broad categories of harmful activity: malware, botnets, phishing, pharming, and spam (when it serves as a delivery mechanism for the other forms of DNS Abuse)) and, as advocates for a better Internet, we believe there is a fundamental need for the industry to come together to create a unified approach to handle it. Right now, some registrars, registries, and hosting providers take action on illegal activity, but others do not, and they become a breeding ground for it.' 

Source: https://tucowsdomains.com/making-the-internet-better/

You can reply to them and remind them of their responsibilities (they must take actions and suspend domains that violate the registrar's ToS), do not hesitate to include the link mentioned above as well as this one: https://tucowsdomains.com/report-abuse/#phishing

[examplens]

What does this mean? Should we report this to the authorities as well? Aren't they the web hosts?

I will report the authority email mentioned in their reply. I don't know if i have to send proof to exch support email as well or no need for that.

I received a similar response from the registrar, so I forwarded it to the email address police.gov.cy.
This is their answer.

Code:

Cybercrime Unit received your message and the report you made to our platform as well.

Regarding the above matter, you should inform the company in order to take appropriate measures about the fake website.

In case our help is needed, this must be received through the designated police cooperation channels.


With Regards,

Yianna Chrysostomou

Cybercrime Unit

Cyprus Polic

Maybe someone official from eXch to contact them

You can reply to them and remind them of their responsibilities (they must take actions and suspend domains that violate the registrar's ToS), do not hesitate to include the link mentioned above as well as this one: https://tucowsdomains.com/report-abuse/#phishing

I saw your reply to Tucows from the email correspondence on my report. As far as I know, Tucows does not sell domains directly to end users, but through partners who only use their network. I think it would be better to put pressure on the reseller partner

[Amuro]

BTC Address: bc1q646seykds7qctfzyq7wr7u9e7k47q9gp8jftqh