[OPEN] eXch Anti-Phishing Campaign

[examplens]

If some good soul would compile a list of all the fake exch.net domains and list them one per line we could add them to the Domainsure Crypto Defender threat feed:

Currently, we are focused on taking down 2 specific phishing domains of exch.net that I have listed below.

- https://www.monero.forex
- https://www.exch.cd

I am very short on time, but if someone can compile a complete list of "active" phishing domains related to eXch, I can add them to https://cryptofraudexpose.org/

I hope that I will have some more time tomorrow, so that I can enter the latest update on the website

btw. About 1api.net, as far as I can see, their headquarters are in Germany. Do we have someone here who  speaks German and is willing to make a phone call and present the whole matter more directly?

[Mpamaegbu]

Finally, ask the registrar to do its job and shutdown the phishing site it's providing services to.

This is well detailed, and thanks for your time for providing another framework. We keep hitting them until they all go down.

[Abu-Naim]

bc1qttnnurgj2ew9rvr3k4wyfnlaaekdqgxez4tsvk

I want to participate in this Anti phishing campaign

[Pmalek]

I want to participate in this Anti phishing campaign

You can report exch[.]cd and try to persuade the registrar to shut it down. The other sites are offline.

Here are some other email addresses that we can use to get in touch with the people responsible for .cd domains, including exch[.]cd:
dnsadmin@nic.cd, david.k@ocpt.cd, maurice.mufusi@scpt.cd, info@scpt.cd, info@ocpt.cd

[albon]

We don't roll SSL/TLS certs for nuked domains.

I confirm that this is the official easyDNS account on the forum. I received their response today, and I genuinely appreciate their constructive assistance in taking down fraudulent and scam websites that violate their policies.

Here are some other email addresses that we can use to get in touch with the people responsible for .cd domains, including exch[.]cd:
dnsadmin@nic.cd, david.k@ocpt.cd, maurice.mufusi@scpt.cd, info@scpt.cd, info@ocpt.cd

I have tried to contact nic.cd regarding this fraudulent domain , but so far I have not received any response from them.

Thank you, I will try to reach out to the other email addresses.
Hopefully, the remaining two domains will be taken down as soon as possible.

[SamReomo]

I want to participate in this Anti phishing campaign

You can report exch[.]cd and try to persuade the registrar to shut it down. The other sites are offline.

Here are some other email addresses that we can use to get in touch with the people responsible for .cd domains, including exch[.]cd:
dnsadmin@nic.cd, david.k@ocpt.cd, maurice.mufusi@scpt.cd, info@scpt.cd, info@ocpt.cd

Thanks for the list of the e-mail addresses to report that domain and I've just reported the domain to all those e-mail addresses. Hope that domain will also go down soon.  To @Abu-Naim you must add support@exch.cx to bcc while reporting that phishing domain to be eligible for the campaign.

[Mpamaegbu]

I want to participate in this Anti phishing campaign

You can report exch[.]cd and try to persuade the registrar to shut it down. The other sites are offline.

It's good to know that monero[.]forex is now offline. I just checked and there's a response mail yesterday from OpenDNS to that effect, acknowledging that it has blocked it in conjunction with Talos. Thanks for providing more emails to hit on exch[.]cd, the last one standing, as it's now.

[Tempaccount1157]

BTC: bc1qz029gy2qjgzwjpuhak0huz4hgkdja2aca3futs

[Woodie]

Is monero[.]Forex nuked or just bad internet from my side, can't seem to open it, someone please confirm.

exch.cd the last musketeer for now

I want to participate in this Anti phishing campaign

You can report exch[.]cd and try to persuade the registrar to shut it down. The other sites are offline.

It's good to know that monero[.]forex is now offline. I just checked and there's a response mail yesterday from OpenDNS to that effect, acknowledging that it has blocked it in conjunction with Talos. Thanks for providing more emails to hit on exch[.]cd, the last one standing, as it's now.

Thanks for the confirmation.
These guys actually came through, it's been a long time coming.

Early April they said monero site was being blocked and now they did their thing, GG openDNS .

I think newbie accounts shouldn't be accepted.

These can be alts of the same person.

Just my suggestion , @exch support.

In support.

Side Note.

Have People read the OP to see how far this fight has come from

[DubemIfedigbo001]

Is monero[.]Forex nuked or just bad internet from my side, can't seem to open it, someone please confirm.

I can confirm it with the following image below


I believe they're down now and the community have really won them. I feel very good that the battle is narrowing down to it's end. From my assessment now, it's only eXch.cd that's is the bottleneck as of now and it's already having a warning of unsafe site, so it's very close to victory. We just need other mean attacks to launch against it so it goes down properly and permanently.

[SamReomo]

The fight against those phishing domains wasn't an easy thing and it's still and on go process until that last one goes down. I'm optimistic that soon we'll see that Monero.Forex going down and now that one is down. I hope that from today's mails that we sent, the last one of the domain will also get suspended very soon.


So the above is the report that I sent recently once again only so the authorities at nic.cd may read this and take action against that domain name. I recommend everyone to send this mail or something similar to they might take action against it and suspend that phishing domain name.

[PX-Z]

Is monero[.]Forex nuked or just bad internet from my side, can't seem to open it, someone please confirm.

Its confirm that its now down, i checked different tools online. Good news to the community for the effort.

Now, it's only the .cd domain, if its registrar is cooperating it should be down from the time google indicated it as a phishing/deceptive site.

[LennyC]

The dot CD domain is still using cloud flare.

I know the goal is to get the domain, but they will quickly disable the site with a single valid phishing report.

[Haunebu]

Monero.forex went down at last and I feel that EasyDNS is responsible for it. Good stuff Bitcointalk team. Another big reason for these domains going down recently is the scammers losing motivation to continue operating them after exch.net decided to shutdown.

Just 1 blacklisted exch.cd remaining.

[Asiska02]

I want to participate in this Anti phishing campaign

You can report exch[.]cd and try to persuade the registrar to shut it down. The other sites are offline.

Here are some other email addresses that we can use to get in touch with the people responsible for .cd domains, including exch[.]cd:
dnsadmin@nic.cd, david.k@ocpt.cd, maurice.mufusi@scpt.cd, info@scpt.cd, info@ocpt.cd

exch[.]cd have proved so many times the tough guys in this fight, no response from them no matter the number of messages sent to their mails to take down the sites. I have also reported to all the emails you’ve provided to further intensify the report, but still no response from them. Similar was seen from domains registered under NameCheap but after the intensity of the report gets going, they had to bow down and block those sites. This will also go down in the soonest definitely. We keep the fight going.

[Pmalek]

These guys actually came through, it's been a long time coming.

Early April they said monero site was being blocked and now they did their thing, GG openDNS .

No, it's not them. I have had that email and information that they are blocking the site since mid-April. It only means that people who use OpenDNS or Umbrella will see a warning message when they try to load the website. It's similar to the red-page Google Safe Browsing warning. You can still bypass it and visit the website if you want. OpenDNS didn't take the site down. It was never in their hands. 

[LoyceV]

This is truly impressive! I've never before seen a domain registrar risk money to test if a site steals from their customers.

What happens to nuked phishing domains in the long run? Will they become available again once their registration expires in the future, or will they stay locked forever?

[NotATether]

What happens to nuked phishing domains in the long run? Will they become available again once their registration expires in the future, or will they stay locked forever?

They're seized by the registrar. It would not make much sense to release them after that, since a different scammer could just buy the domain on auction.

[Woodie]

A few things that can be the final nail to this.

Invite the registrar to have a test transaction and see if coins will be exchanged and transferred to them, if not it proves what kind of site exch[.]cd is (phishing website) .

Something worth looking at for the registrar, we have them compare the two websites, the phishing site has an old snapshot and numbers never change, never gets notifications like whats on the real one, and the knockoff shows 24hr data while real one moved to monthly stats for customers privacy concerns...

Registrar has to act now.

[xenomorfo]

but am I wrong or does it say on the official website that from May 1st they will no longer accept orders? What does it mean that they are closing forever?
The service was excellent and I had recommended it to many ancap brothers
I'm sorry if it closes forever honestly