[OPEN] eXch Anti-Phishing Campaign

[examplens]

I read the story but am somewhat baffled. It seems as though eXch hosted their servers in Germany and that seems a strange thing to do. Also, it was reported  over eight terabytes of server data was seized. That is a lot of data and there were reports about CM having similar amounts confiscated at the time they were seized. having said that, no reports of arrests were made.

If I understand correctly, eXch had its own nodes for each coin they had listed on their platform. Full nodes on BTC, ETH, LTC, and Dash are certainly in TB-sized.

I do not think that they would store their coins on centralized services. Therefore, there are many questions about how the coins were seized

eXch was a centralized service. Seize the server, seize the coins.

A centralized service does not have to have a wallet (and coins) on the same server as the application.

[Cricktor]

Also, it was reported  over eight terabytes of server data was seized. That is a lot of data and there were reports about CM having similar amounts confiscated at the time they were seized. having said that, no reports of arrests were made.

The authorities can say anything and certainly want to make it look good what they've done in the press release. Big round of shoulder patting... Much heroes, so wow... Big yawn! Not impressed.

It could just be an eight TB SSD, maybe encrypted, maybe not, holding data of different coin nodes. Who knows, so what? Same psycho game procedure as commonly executed in similar cases. Still not impressed.

It seems a lot of people really quickly reflex to "it must be a huge pile of logging data, shudder". I don't think so, but frankly there's about zero evidence, just the usual bla bla in such authorities' press releases. They'd be stupid to present anything substantial. And we'd be more stupid to blow it up based on their press fart like the yellow press would do.

[NotATether]

I read the story but am somewhat baffled. It seems as though eXch hosted their servers in Germany and that seems a strange thing to do. Also, it was reported  over eight terabytes of server data was seized. That is a lot of data and there were reports about CM having similar amounts confiscated at the time they were seized. having said that, no reports of arrests were made.

If I understand correctly, eXch had its own nodes for each coin they had listed on their platform. Full nodes on BTC, ETH, LTC, and Dash are certainly in TB-sized.

A full Ethereum archival node running the go-ethereum software that eXch was known to compile from source in the past, requires at least 12 TB.

https://geth.ethereum.org/docs/getting-started/hardware-requirements

However, if the full archival state is not stored, it could be under 2 terabytes.

The Bitcoin node requires about 600GB. Monero 100GB. Dash and Litecoin's blockchain size is negligible. However, Lightning network takes up a couple more hundreds of GB of space, depending on the client. If you also include the programs that eXch use like Thorchain for isntance, those uses several hundred gigabytes in total as well. We do not know exactly what software was eXch running on the server but it's highly likely that the nodes accounted for the bulk of the storage space.

Logs are not terabytes large. At most, hundreds of megabytes typically.

If they had foresight, they would have encrypted the hard disk with LUKS beforehand. Hopefully, they did that.

[Juicyhome]

Btc Address: bc1qqrv48we5mrflsrp30x8wvmgc57l9kwgcpurkd6

I just reported the fake websites, i hope they remove them quickly.

[zasad@]

I read the story but am somewhat baffled. It seems as though eXch hosted their servers in Germany and that seems a strange thing to do. Also, it was reported  over eight terabytes of server data was seized. That is a lot of data and there were reports about CM having similar amounts confiscated at the time they were seized. having said that, no reports of arrests were made.

If I understand correctly, eXch had its own nodes for each coin they had listed on their platform. Full nodes on BTC, ETH, LTC, and Dash are certainly in TB-sized.

A full Ethereum archival node running the go-ethereum software that eXch was known to compile from source in the past, requires at least 12 TB.

https://geth.ethereum.org/docs/getting-started/hardware-requirements

However, if the full archival state is not stored, it could be under 2 terabytes.

The Bitcoin node requires about 600GB. Monero 100GB. Dash and Litecoin's blockchain size is negligible. However, Lightning network takes up a couple more hundreds of GB of space, depending on the client. If you also include the programs that eXch use like Thorchain for isntance, those uses several hundred gigabytes in total as well. We do not know exactly what software was eXch running on the server but it's highly likely that the nodes accounted for the bulk of the storage space.

Logs are not terabytes large. At most, hundreds of megabytes typically.

If they had foresight, they would have encrypted the hard disk with LUKS beforehand. Hopefully, they did that.

I also agree that coins are not stored on computers or servers. If the police confiscate a server, they still need a lot of time to decrypt the data and gain access with private keys.
I can't even believe that someone now stores data in an unencrypted form.

[LoyceV]

I can't even believe that someone now stores data in an unencrypted form.

The disk may be encrypted, but the server can't run if it isn't unlocked. Physical access does the rest:

the consensus seemed to be that preventing data access when someone has physical access to the server (the machine is turned on and running applications) is nearly impossible.

[zasad@]

I can't even believe that someone now stores data in an unencrypted form.

The disk may be encrypted, but the server can't run if it isn't unlocked. Physical access does the rest:

the consensus seemed to be that preventing data access when someone has physical access to the server (the machine is turned on and running applications) is nearly impossible.

I have absolutely no knowledge to argue with security experts, but there are many other ways to secure your coins, for example, not storing all coins on 1 server and so on.

It seems that states are hunting for coins and not for people, although by government standards this is a very small value.

[Woodie]

monero[•]Forex Nuked.

Maybe this time monero[•]Forex is history as reported by phishing report.

Hope eXch support can also come through with an update on campaign as a little communication here and there is encouraging and also address the other elephant in the room.

[Pmalek]

monero[•]Forex Nuked.

Maybe this time monero[•]Forex is history as reported by phishing report.

Sweet!
So they did the work, right? Isn't Phish Report a paid service or do they also work for free? Did they require any information and proof from your end?

[examplens]

monero[•]Forex Nuked.

Maybe this time monero[•]Forex is history as reported by phishing report.

OK, let's hope this is the end of it and there won't be any more domain transfer tricks.

I also previously reported X account of this scammer, and it seems that something happened here too, because this X account is temporarily restricted. It is probably under investigation by X



https://x.com/IWriteAboutXMR

I believe that a report with more X accounts would help for a final ban.

[Haunebu]

Maybe this time monero[•]Forex is history as reported by phishing report.

Great stuff. Good to see Monero.forex nuked again.

Isn't Phish Report a paid service or do they also work for free? Did they require any information and proof from your end?

It is a paid service, but you can use some of their tools for free. I remember reporting almost all of the domains in the list way back using phish.report free tools(Takedown service etc).

[GazetaBitcoin]

Having monero[.]forex dismantled, it means there is only one more website to be "resolved", respectively exch[.]cd.

However, considering that eXch shut down their services, I am wondering if the anti phishing campaign is still running, from their perspective. Perhaps OP can tell us what's their position about this...? Will the rewards be given for the websites which were taken down just before they shut down (meaning for exch[.]cy and darknetbible[.]info) and also for taking down monero[.]forex; and, eventually, for taking down exch[.]cy as well (in case this will also happen)...?

[NotATether]

Having monero[.]forex dismantled, it means there is only one more website to be "resolved", respectively exch[.]cd.

However, considering that eXch shut down their services, I am wondering if the anti phishing campaign is still running, from their perspective. Perhaps OP can tell us what's their position about this...? Will the rewards be given for the websites which were taken down just before they shut down (meaning for exch[.]cy and darknetbible[.]info) and also for taking down monero[.]forex; and, eventually, for taking down exch[.]cy as well (in case this will also happen)...?

Where will they get the rewards from? All of their coins have been seized (would never have happened if they had at least moved them to a hardware wallet). Just report them for free.

Alternatively from the registrar's point of view, you can just report to them that eXch was taken down by law enforcement and that this site is a clone that should not be providing services to users. From a legal point of view; both from a legal point of view and also from the scamming side of things.

[JollyGood]

If I understand correctly, eXch had its own nodes for each coin they had listed on their platform. Full nodes on BTC, ETH, LTC, and Dash are certainly in TB-sized.

That seems a reasonable assumption. Running full nodes for that many coins will occupy space in several TB (but nowhere near as much as they claim to have recovered).

The authorities can say anything and certainly want to make it look good what they've done in the press release. Big round of shoulder patting... Much heroes, so wow... Big yawn! Not impressed.

A full Ethereum archival node running the go-ethereum software that eXch was known to compile from source in the past, requires at least 12 TB.

https://geth.ethereum.org/docs/getting-started/hardware-requirements

However, if the full archival state is not stored, it could be under 2 terabytes.

The Bitcoin node requires about 600GB. Monero 100GB. Dash and Litecoin's blockchain size is negligible. However, Lightning network takes up a couple more hundreds of GB of space, depending on the client. If you also include the programs that eXch use like Thorchain for isntance, those uses several hundred gigabytes in total as well. We do not know exactly what software was eXch running on the server but it's highly likely that the nodes accounted for the bulk of the storage space.

Logs are not terabytes large. At most, hundreds of megabytes typically.

If they had foresight, they would have encrypted the hard disk with LUKS beforehand. Hopefully, they did that.

We will probably find out about this in the coming days. Exactly what was recovered still remains a mystery.

However, considering that eXch shut down their services, I am wondering if the anti phishing campaign is still running, from their perspective. Perhaps OP can tell us what's their position about this...? Will the rewards be given for the websites which were taken down just before they shut down

According to a recent report, German authorities raided and shut down eXch two days before their unilateral decision to voluntarily close their business down. The OP has not been online since 6th May therefore it seems reasonable to assume they will not be back and as a result subsequent payments will probably not be made.

[examplens]

Having monero[.]forex dismantled, it means there is only one more website to be "resolved", respectively exch[.]cd.

darknetbible[.]info is still online. He managed to dodge the suspension by transferring to another registrar

Having monero[.]forex dismantled, it means there is only one more website to be "resolved", respectively exch[.]cd.

However, considering that eXch shut down their services, I am wondering if the anti phishing campaign is still running, from their perspective. Perhaps OP can tell us what's their position about this...? Will the rewards be given for the websites which were taken down just before they shut down (meaning for exch[.]cy and darknetbible[.]info) and also for taking down monero[.]forex; and, eventually, for taking down exch[.]cy as well (in case this will also happen)...?

Where will they get the rewards from? All of their coins have been seized (would never have happened if they had at least moved them to a hardware wallet). Just report them for free.

If I remember correctly, they were deposited funds for this campaign in escrow with the manager, and he made the payment from there.
Even if there is no direct reward, it is a scam scheme, and we need to fight against such people. It's not just a matter of eXch service, it's a matter of general hygiene.

[GazetaBitcoin]

darknetbible[.]info is still online. He managed to dodge the suspension by transferring to another registrar

Sigh...

Even if there is no direct reward, it is a scam scheme, and we need to fight against such people. It's not just a matter of eXch service, it's a matter of general hygiene.

I totally agree. And I, on my side, have reported all the phishing clones. I was thinking though that an official position from eXch would be welcome on this matter.

[Woodie]

If I remember correctly, they were deposited funds for this campaign in escrow with the manager, and he made the payment from there.

Damn things happened so quick... We might just be having another "not your keys, not your coins campaign v2 "

Btw, by manager do you mean eXch support or different Bitcointalk user ??

And is this escrow setup in the public domain for verification?

Even if there is no direct reward, it is a scam scheme, and we need to fight against such people. It's not just a matter of eXch service, it's a matter of general hygiene.

Cyber hygiene, Fair enough  

[SamReomo]

I totally agree. And I, on my side, have reported all the phishing clones. I was thinking though that an official position from eXch would be welcome on this matter.

In first batch of suspended domains, they gave rewards but who knows this time they'll give rewards or not. It's like a fight against the phishing domains now and we'll do it for free. I've reported those phishing domains multiple times and soon, I'll report the remaining one again. Although, I don't think that NIC.CD will take any action but still we don't lose anything by reporting to them.

[Ambatman]

I just read that Germany seized eXch's assets and shut it down, in May 9th.  eXch Support hasn't logged in since May 6th.  I'm concerned whether the people working for this exchange are in trouble.  Hopefully, not.

Wow I didn't even know about this. I thought the thread has ended since all the sites were nuked
But it turns out some are just like cockroaches.
I hope they are alright and can atleast see a reward for their contribution to the privacy centered community.

I totally agree. And I, on my side, have reported all the phishing clones. I was thinking though that an official position from eXch would be welcome on this matter.

In first batch of suspended domains, they gave rewards but who knows this time they'll give rewards or not. It's like a fight against the phishing domains now and we'll do it for free. I've reported those phishing domains multiple times and soon, I'll report the remaining one again.

The campaign thought me how to report phishing site and was able to do same for one phishing mixtum.

darknetbible[.]info is still online. He managed to dodge the suspension by transferring to another registrar

This guy....... On what basis are we reporting this?
Because o couldn't find any evidence of their phishing site promotion.

[examplens]

darknetbible[.]info is still online. He managed to dodge the suspension by transferring to another registrar

This guy....... On what basis are we reporting this?
Because o couldn't find any evidence of their phishing site promotion.

https://cryptofraudexpose.org/
You have evidence that it is an identical copy of the DNM Bible onion site, but it only points to phishing sites.