[OPEN] eXch Anti-Phishing Campaign

[Cricktor]

As I mentioned in my earlier post, hosting providers can takedown scam domains sometimes. IP Volume is the hosting provider of exch.cash and they replied to me saying that the reseller has been informed to take immediate action.

Taking down the hoster is only a short nuisance for the fraudster. He'll hop to another hoster and point the domain name to the new one. Nothing changes.

Used ICANN domain lookup and found out that easyDNS technologies inc is the reseller. Sent an abuse report to them too. Let's see what happens.

The fraudster may have a contract with easyDNS Technologies Inc., it can't hurt to report the fraudster there, too.

As Tucows refuses to take responsibility and cut the wire for the malicious actor, I'm going to try to report their inactivity one level higher. Will need to figure out who that might be. Any hints are much appreciated.

It's sad that Tucows doesn't want to acknowledge that it's key for the fraudster to have control where the domain name exch[.]cash points to.

[mirtotanota]

i received this message few days ago, and reported in mentioned link too

https://i.imgur.com/KM2osPz.jpeg

and did you get paid for domains that suspended

[Cricktor]

You're Copper Member and still don't use proper [img]<picture URL>[/img] BBcode tags for inline pictures? And before asking if anyone already has been paid for taken down domain names, you should read the terms after which reporters will share a payout for documented reporting, especially the part that a domain name needs to be suspended for at least one month.

[igebotz]

The below quote was their reply, and I hope they’ll take action now.

I am not disputing the mal intent. However, Tucows is not a trier of facts and the domain would require due process. We have assisted in coordinating this complaint to the corresponding provider.
Regards
Compliance Officer * Tucows Inc/Ascio/Epag/Enom https://www.tucowsdomains.com/compliance-form/.
https://tucowsdomains.com/report-abuse/.
~shortStepsLongReaches~

Who are the corresponding provider! This is an attempt to pass responsibilities to non-existed "corresponding provider". They're the provider.

and did you get paid for domains that suspended

Read the OP thoroughly.

[mirtotanota]

Read the OP thoroughly.

Sorry about that original post edited, and I didn't read that again, I just check that

[Cyberczar]

BTC wallet: bc1q0qnlt9w3t8p0vwkm7csz7tdzxmyedhcrar0e0d

[NotATether]

Taking down the hoster is only a short nuisance for the fraudster. He'll hop to another hoster and point the domain name to the new one. Nothing changes.

Unless the scammer has no backups, but any competent scammer would.

Tucows is the registrar for Njalla, one of the "privacy-focused" domain name sellers (they are not authorized to register domains themselves), but they chicken out and suspend domains as soon as you report them.

I am saying this because Tucows probably makes them do this or else they terminate their contract with them.

It seems that Tucows won't do anything unless threatened with legal action.

[Cricktor]

It seems that Tucows won't do anything unless threatened with legal action.

I'm not sure what the correct instance is to report the ignorance of Tucows as registrar. If it's ICANN or whatever, I'm fine to report to them that Tucows refuses to take action to cut malicious use of the domain name for the fraudster.

If many from here report Tucows registrar for their negligence, then that might put enough pressure on them to reconsider their lame stance.

[ovcijisir]

It seems that Tucows won't do anything unless threatened with legal action.

I'm not sure what the correct instance is to report the ignorance of Tucows as registrar. If it's ICANN or whatever, I'm fine to report to them that Tucows refuses to take action to cut malicious use of the domain name for the fraudster.

If many from here report Tucows registrar for their negligence, then that might put enough pressure on them to reconsider their lame stance.

If you send mail to ICANN please share the contact here, I'm also willing to send them mail to highlights that Tucows refuse to take responsibility for their work.

[Sekhmet_]

It seems that Tucows won't do anything unless threatened with legal action.

I'm not sure what the correct instance is to report the ignorance of Tucows as registrar. If it's ICANN or whatever, I'm fine to report to them that Tucows refuses to take action to cut malicious use of the domain name for the fraudster.

If many from here report Tucows registrar for their negligence, then that might put enough pressure on them to reconsider their lame stance.

If you send mail to ICANN please share the contact here, I'm also willing to send them mail to highlights that Tucows refuse to take responsibility for their work.

https://icann-nsp.my.site.com/compliance/s/abuse-domain

Found on https://www.icann.org/compliance/complaint

[Pmalek]

I'm not sure what the correct instance is to report the ignorance of Tucows as registrar. If it's ICANN or whatever, I'm fine to report to them that Tucows refuses to take action to cut malicious use of the domain name for the fraudster.

If many from here report Tucows registrar for their negligence, then that might put enough pressure on them to reconsider their lame stance.

I will report them for not being willing to take action as well but we need to know what the right party to send those reports to are and who is the correct higher authority than Tucows.

[Cricktor]

I checked that Tucows is an ICANN-accredited registrar. I'll have to read through below mentioned agreements first.

ICANN has executed certain agreements with registrars and registry operators. ICANN's Contractual Compliance authority is limited to the obligations set forth in these agreements. These agreements are the Registrar Accreditation Agreement, the Registry Agreements and the Consensus Policies. If your issue is outside of this contractual scope or if it involves a party over whom ICANN has no compliance enforcement powers, ICANN will provide you with alternative avenues you may want to pursue.

Additional information on how to submit complaints concerning requests for access to non-public registration data can be found here.

In a table from above quoted ICANN site it's stated:

Take_mitigation_action(s)_to_stop_or_disrupt_the_use_of_a_domain_name
Issue	Additional information & Submit Complaint
A registrar's failure to: ... Take mitigation action(s) to stop or disrupt the use of a domain name for DNS Abuse (malware, botnets, phishing, pharming, and spam when spam is used to deliver any of the other four types of DNS Abuse).	Abuse/DNS Abuse (Registrar)

At first glance, it seems to me that this could be the right place to complain about Tucows' refusal to act to mitigate the phishing abuse of the malicious domain exch[.]cash.

[Haunebu]

ICANN does put pressure on registrars to fulfill their obligations sometimes, but I feel it's a long shot based on my research. We could all complain to ICANN about Tucows, but I wouldn't expect much.

Instead, I recommend everyone to report properly to Google Safe Browsing and Microsoft Security Intelligence(Done myself) so that all of these domains could get blacklisted as malicious sites which is the next best thing.

[xOrpian]

https://icann-nsp.my.site.com/compliance/s/abuse-domain

Found on https://www.icann.org/compliance/complaint

The host 'IP Volume Inc' can be changed by the scammer who's phishing, but the registrar will remain the same 'Tucows', I sent them an email yesterday night and am waiting to hear back from them about it.

I think I'll wait a few days to hear from them before I proceed to ICANN since they mentioned they're assisting with the case, but still, the Registrar's inability to suspend the domain does raise some bells.

[yamin_galib]

I am also going to join to fight against phishing links..

Here is my Bitcoin address :- bc1q6yccqrshgad26hkdyq4qsyat2kagqra5wtwnj4

[Haunebu]

Exch.live down people. This new addition to the list got taken down pretty quickly. Cloudflare could have possibly have had something to do with this, but I am not sure. Anyway, let's keep applying pressure on the remaining scam domains.

[apogio]

Exch.live down people. This new addition to the list got taken down pretty quickly. Cloudflare could have possibly have had something to do with this, but I am not sure. Anyway, let's keep applying pressure on the remaining scam domains.

Awesome, it must be the third one that's taken down.

[examplens]

Tucows points us all to their partner where the exch [.] cash domain is registered, but they can't confirm which partner it is. At the very end of the report from the whois database, there is information that it is easyDNS Technologies Inc
I just reported this domain to them, so I invite others to do the same.
email address is: abuse@easydns.com

Code:

https://whois.domaintools.com/exch.cash

[katanic97]

Reported

bc1qv6xskpde03lz6crl0ur5d7e9420w4k8usnj6hr

[Basels]

wallet: bc1qutflramv4sjd7p8enhputfrqa2j9u5dsy8l6h9