[OPEN] eXch Anti-Phishing Campaign

[SamReomo]

Got this automated reply from them, hope they might take some action against the domain name.

[Woodie]

Am now lost, what are all these domains for  

See here only a few posts back:

If some good soul would compile a list of all the fake exch.net domains and list them one per line we could add them to the Domainsure Crypto Defender threat feed:

https://domainsure.com/rpz-threat-feeds/

That gets pushed out to resolver services (like Quad9) which can dampen the reach of known phishing domains before they get taken down.

fake exch.net domains.... Meaning phishing sites??

Are we saying besides "exch[.]cd"from that list, are we confirming the rest are clones and phishing sites too ??

Have you tried opening any of those domains? I have and they are either for sell or not pointing to anything which is why I raised my question ❓

Btw, Without dragging any names into this, how do we verify easyDNS are who they say they are on the forum...tried asking to verify this account on twitter(X),  haven't got a reply from them yet

[examplens]

If some good soul would compile a list of all the fake exch.net domains and list them one per line we could add them to the Domainsure Crypto Defender threat feed:

Currently, we are focused on taking down 2 specific phishing domains of exch.net that I have listed below.

- https://www.monero.forex
- https://www.exch.cd

I am very short on time, but if someone can compile a complete list of "active" phishing domains related to eXch, I can add them to https://cryptofraudexpose.org/

I hope that I will have some more time tomorrow, so that I can enter the latest update on the website

btw. About 1api.net, as far as I can see, their headquarters are in Germany. Do we have someone here who  speaks German and is willing to make a phone call and present the whole matter more directly?

[Mpamaegbu]

Finally, ask the registrar to do its job and shutdown the phishing site it's providing services to.

This is well detailed, and thanks for your time for providing another framework. We keep hitting them until they all go down.

[Abu-Naim]

bc1qttnnurgj2ew9rvr3k4wyfnlaaekdqgxez4tsvk

I want to participate in this Anti phishing campaign

[Pmalek]

I want to participate in this Anti phishing campaign

You can report exch[.]cd and try to persuade the registrar to shut it down. The other sites are offline.

Here are some other email addresses that we can use to get in touch with the people responsible for .cd domains, including exch[.]cd:
dnsadmin@nic.cd, david.k@ocpt.cd, maurice.mufusi@scpt.cd, info@scpt.cd, info@ocpt.cd

[albon]

We don't roll SSL/TLS certs for nuked domains.

I confirm that this is the official easyDNS account on the forum. I received their response today, and I genuinely appreciate their constructive assistance in taking down fraudulent and scam websites that violate their policies.

Here are some other email addresses that we can use to get in touch with the people responsible for .cd domains, including exch[.]cd:
dnsadmin@nic.cd, david.k@ocpt.cd, maurice.mufusi@scpt.cd, info@scpt.cd, info@ocpt.cd

I have tried to contact nic.cd regarding this fraudulent domain , but so far I have not received any response from them.

Thank you, I will try to reach out to the other email addresses.
Hopefully, the remaining two domains will be taken down as soon as possible.

[SamReomo]

I want to participate in this Anti phishing campaign

You can report exch[.]cd and try to persuade the registrar to shut it down. The other sites are offline.

Here are some other email addresses that we can use to get in touch with the people responsible for .cd domains, including exch[.]cd:
dnsadmin@nic.cd, david.k@ocpt.cd, maurice.mufusi@scpt.cd, info@scpt.cd, info@ocpt.cd

Thanks for the list of the e-mail addresses to report that domain and I've just reported the domain to all those e-mail addresses. Hope that domain will also go down soon.  To @Abu-Naim you must add support@exch.cx to bcc while reporting that phishing domain to be eligible for the campaign.

[Mpamaegbu]

I want to participate in this Anti phishing campaign

You can report exch[.]cd and try to persuade the registrar to shut it down. The other sites are offline.

It's good to know that monero[.]forex is now offline. I just checked and there's a response mail yesterday from OpenDNS to that effect, acknowledging that it has blocked it in conjunction with Talos. Thanks for providing more emails to hit on exch[.]cd, the last one standing, as it's now.

[Tempaccount1157]

BTC: bc1qz029gy2qjgzwjpuhak0huz4hgkdja2aca3futs

[Woodie]

Is monero[.]Forex nuked or just bad internet from my side, can't seem to open it, someone please confirm.

exch.cd the last musketeer for now

I want to participate in this Anti phishing campaign

You can report exch[.]cd and try to persuade the registrar to shut it down. The other sites are offline.

It's good to know that monero[.]forex is now offline. I just checked and there's a response mail yesterday from OpenDNS to that effect, acknowledging that it has blocked it in conjunction with Talos. Thanks for providing more emails to hit on exch[.]cd, the last one standing, as it's now.

Thanks for the confirmation.
These guys actually came through, it's been a long time coming.

Early April they said monero site was being blocked and now they did their thing, GG openDNS .

I think newbie accounts shouldn't be accepted.

These can be alts of the same person.

Just my suggestion , @exch support.

In support.

Side Note.

Have People read the OP to see how far this fight has come from

[DubemIfedigbo001]

Is monero[.]Forex nuked or just bad internet from my side, can't seem to open it, someone please confirm.

I can confirm it with the following image below


I believe they're down now and the community have really won them. I feel very good that the battle is narrowing down to it's end. From my assessment now, it's only eXch.cd that's is the bottleneck as of now and it's already having a warning of unsafe site, so it's very close to victory. We just need other mean attacks to launch against it so it goes down properly and permanently.

[SamReomo]

The fight against those phishing domains wasn't an easy thing and it's still and on go process until that last one goes down. I'm optimistic that soon we'll see that Monero.Forex going down and now that one is down. I hope that from today's mails that we sent, the last one of the domain will also get suspended very soon.


So the above is the report that I sent recently once again only so the authorities at nic.cd may read this and take action against that domain name. I recommend everyone to send this mail or something similar to they might take action against it and suspend that phishing domain name.

[PX-Z]

Is monero[.]Forex nuked or just bad internet from my side, can't seem to open it, someone please confirm.

Its confirm that its now down, i checked different tools online. Good news to the community for the effort.

Now, it's only the .cd domain, if its registrar is cooperating it should be down from the time google indicated it as a phishing/deceptive site.

[LennyC]

The dot CD domain is still using cloud flare.

I know the goal is to get the domain, but they will quickly disable the site with a single valid phishing report.

[Haunebu]

Monero.forex went down at last and I feel that EasyDNS is responsible for it. Good stuff Bitcointalk team. Another big reason for these domains going down recently is the scammers losing motivation to continue operating them after exch.net decided to shutdown.

Just 1 blacklisted exch.cd remaining.

[Asiska02]

I want to participate in this Anti phishing campaign

You can report exch[.]cd and try to persuade the registrar to shut it down. The other sites are offline.

Here are some other email addresses that we can use to get in touch with the people responsible for .cd domains, including exch[.]cd:
dnsadmin@nic.cd, david.k@ocpt.cd, maurice.mufusi@scpt.cd, info@scpt.cd, info@ocpt.cd

exch[.]cd have proved so many times the tough guys in this fight, no response from them no matter the number of messages sent to their mails to take down the sites. I have also reported to all the emails you’ve provided to further intensify the report, but still no response from them. Similar was seen from domains registered under NameCheap but after the intensity of the report gets going, they had to bow down and block those sites. This will also go down in the soonest definitely. We keep the fight going.

[Pmalek]

These guys actually came through, it's been a long time coming.

Early April they said monero site was being blocked and now they did their thing, GG openDNS .

No, it's not them. I have had that email and information that they are blocking the site since mid-April. It only means that people who use OpenDNS or Umbrella will see a warning message when they try to load the website. It's similar to the red-page Google Safe Browsing warning. You can still bypass it and visit the website if you want. OpenDNS didn't take the site down. It was never in their hands. 

[LoyceV]

This is truly impressive! I've never before seen a domain registrar risk money to test if a site steals from their customers.

What happens to nuked phishing domains in the long run? Will they become available again once their registration expires in the future, or will they stay locked forever?

[NotATether]

What happens to nuked phishing domains in the long run? Will they become available again once their registration expires in the future, or will they stay locked forever?

They're seized by the registrar. It would not make much sense to release them after that, since a different scammer could just buy the domain on auction.