[OPEN] eXch Anti-Phishing Campaign

[Cricktor]

Unfortunately I've no logs how their mailserver behaved and which IP addresses were involved with eXch's mail infrastructure. Didn't feel the need to store some log samples for later comparison, as I didn't really anticipate that authorities would be so close after them (yes, eXch said they've received warnings from some informants, but anyway).

I'm raising the question if eXch is still in control of their mail infrastructure or if whatever authorities are "tapping the wires". Be careful which IP addresses YOU expose with your emails.

As authorities don't seem to care much about real scammers and/or cyber criminals and rather take down privacy centric services which they tag for money laundering. Guess who makes the first steps to launder stolen money or coins? It's the cyber criminals who exploit or use available services. Why don't authorities try to hunt them down? Because it's more difficult? Ya, I get it...

[DYING_S0UL]

We have already done all that we can and screwed the scammers effectively people. Most of the domains in the list have been suspended and the only remaining ones are useless because darknet points towards monero.forex which is dead while exch.cd got blacklisted.

While the original eXch ended up being seized, the fake phishing ones are still roaming freely without any issue. The authorities be like. "Ha ha ha, Not our problem". And that's called maintaining double standard!

[PX-Z]

We have already done all that we can and screwed the scammers effectively people. Most of the domains in the list have been suspended and the only remaining ones are useless because darknet points towards monero.forex which is dead while exch.cd got blacklisted.

While the original eXch ended up being seized, the fake phishing ones are still roaming freely without any issue. The authorities be like. "Ha ha ha, Not our problem". And that's called maintaining double standard!

Actually, the job of the authorities to close and shutdown eXch is one way and another to make those phishing sites ineffective, they've effectively weakened the impact of those related phishing sites. That's why once the site was officially seized, I stopped reporting those phishing links, our job was essentially done. I would’ve continued if they just closed/stop their service but since that's not how it goes, so....

[joker_josue]

As authorities don't seem to care much about real scammers and/or cyber criminals and rather take down privacy centric services which they tag for money laundering. Guess who makes the first steps to launder stolen money or coins? It's the cyber criminals who exploit or use available services. Why don't authorities try to hunt them down? Because it's more difficult? Ya, I get it...

It's not a question of being more difficult, it's because it has the same level of difficulty.

Catching a scam like eXch is not easy, it involves a lot of time, resources and research. But, shutting down a simple phishing site takes about the same amount of time.

As we saw during that campaign, we denounced one - it was closed, but soon another one appeared. For the authorities, they want to go further, to catch who is behind these sites. Given the resources needed, they have to make choices about who to go after. They usually choose to go after the biggest one, the one that theoretically causes the most damage.

While a phishing site steals a few hundred, for them eXch was used to launder millions. This made eXch a priority. In turn, as @PX-Z commented, by closing the main site, all phishing sites lose their effectiveness, as the original no longer exists.

In a year's time, these sites will no longer exist, because their owner will simply stop paying for the domain. The crook will now look for another scheme, another website to copy and try to deceive.

[examplens]

While a phishing site steals a few hundred, for them eXch was used to launder millions. This made eXch a priority. In turn, as @PX-Z commented, by closing the main site, all phishing sites lose their effectiveness, as the original no longer exists.

Do absolutely all eXch users know that the original service has been seized?
Also, what about new users who are not informed about all the happenings around this exchange, come to scam sites like darknetbible[.]info and click on the recommendation from there on the phishing exch site? The fact that there are currently no such links does not mean that there won't be any when everything calms down a bit.
Even today there are phishing sites of some mixers that have not existed for a long time, but were recognizable earlier.

[joker_josue]

While a phishing site steals a few hundred, for them eXch was used to launder millions. This made eXch a priority. In turn, as @PX-Z commented, by closing the main site, all phishing sites lose their effectiveness, as the original no longer exists.

Do absolutely all eXch users know that the original service has been seized?
Also, what about new users who are not informed about all the happenings around this exchange, come to scam sites like darknetbible[.]info and click on the recommendation from there on the phishing exch site? The fact that there are currently no such links does not mean that there won't be any when everything calms down a bit.
Even today there are phishing sites of some mixers that have not existed for a long time, but were recognizable earlier.

Unfortunately, they will continue to be able to fool some people, but it will be a little different and less effective. Especially on the model I was using, which was clone style.

Phishing sites are a plague, and no matter how much you fight them, they will only get worse. It's up to each of us, who knows a little more, to report them as much as we can.

[Cricktor]

Catching a scam like eXch is not easy, it involves a lot of time, resources and research. But, shutting down a simple phishing site takes about the same amount of time.

Highlighting with underlining by me and what you say sounds a lot to me like you say, eXch was a scam, which I can say, it wasn't. I think you didn't want to designate eXch as a scam, maybe I'm lost in words or expression, rather a lookalike scam mimiking an instant exchange like eXch was, isn't easy to convict. Well, yes, sort of.

In turn, as @PX-Z commented, by closing the main site, all phishing sites lose their effectiveness, as the original no longer exists.

In a year's time, these sites will no longer exist, because their owner will simply stop paying for the domain. The crook will now look for another scheme, another website to copy and try to deceive.

Someone who knows the genuine original site isn't likely to fall for phishing and scamming carbon-copies. I don't quite follow what PX-Z said. A phishing/scamming carbon-copy is probably still effective as long victims don't realize they're on a malicious carbon-copy site.

Many domains aren't that expensive, even one low tier victim may pay for a long time of domain abuse.

But over time you are likely right as I'd assume that bad scam experience and news should spread around and reach out even to the least informed users, hopefully.

[Woodie]

While the original eXch ended up being seized, the fake phishing ones are still roaming freely without any issue. The authorities be like. "Ha ha ha, Not our problem". And that's called maintaining double standard!

Maybe this is a lil off topic, but regarding the seizure...thought domains were voluntary put down by team eXch as they new what was coming after the tipoff. If seizure happened, am certain a redirect from eXch.cx original domain) to exch.pw wouldn't be happening...

AFAIK what was seized is physical server unless message was lost in translation??

--------
But you are 💯 correct on the double standards of the authorities, because they should be the ones taking down these phishing sites, otherwise we did their job!

[PX-Z]

Do absolutely all eXch users know that the original service has been seized?

I would assume no, but if you already use the service you will probably use on any search engine like the keyword "exch" or "exch.cx".
Google shows the legit .CX website and other related articles, Yandex shows the .PW domain, Bing shows their bitcointalk ann thread and other seizure related articles as well as Duckduckgo.
I don't think darknetbible is relevant website too, it has high spam score, very low da/pa, no organic traffic, almost no visit, no top keywords, so highly likely it wont show in google or any search engine using "exch" keyword or "best/recommended non kyc crypto exchange" or related keywords.

[joker_josue]

Catching a scam like eXch is not easy, it involves a lot of time, resources and research. But, shutting down a simple phishing site takes about the same amount of time.

Highlighting with underlining by me and what you say sounds a lot to me like you say, eXch was a scam, which I can say, it wasn't. I think you didn't want to designate eXch as a scam, maybe I'm lost in words or expression, rather a lookalike scam mimiking an instant exchange like eXch was, isn't easy to convict. Well, yes, sort of.

That's not what I meant. I was speaking from the perspective of the authorities who make the arrests. For the authorities, eXch was a money laundering scheme. That was the sense I was talking about.

Therefore, to catch the owners of eXch, the authorities will spend the same resources as to catch a phishing site that imitates them. They will choose to go after the one that generates the most revenue, which in this case was eXch.

Again, I'm not saying eXch was a scam or fraud, just saying that was the view of some authorities. 

[examplens]

I don't think darknetbible is relevant website too, it has high spam score, very low da/pa, no organic traffic, almost no visit, no top keywords, so highly likely it wont show in google or any search engine using "exch" keyword or "best/recommended non kyc crypto exchange" or related keywords.

Post on X like https://x.com/IWriteAboutXMR/status/1882562470742806959 has a 2.5k impressions. Statistically, 2-3% clicked on a link from there. That's at least 50+ people. 50 potential victims.
I agree with you, but too often we have seen complaints that someone was deceived by a phishing site, and at the same time did not check the rating or originality of the domain.

[zasad@]

~snipped~

It's even worse than that. They somehow managed to let both the scammers and Lazarus Group get away scot-free while taking down eXch.

It's really bizarre, and I can't fathom what the excuse from the authorities that be would be on that double standard.

Lazarus Group is not just a bunch of scammers, but a group that is supposedly a government. These are completely different levels and it is unlikely that anyone will get physical access to their servers.
View this information
https://bitcointalk.org/index.php?topic=5487893.msg65181385#msg65181385

It is impossible to possess such resources without the protection of a strong government.

[SamReomo]

So here it's 27th of may and we haven't heard anything from eXch team and that simply means that the campaign is no more supported by them and there may not be any payments for the domains that were suspended. However, as a community we did our best in it because we wanted to take strict action against the so-called scammers who created phishing websites to scam innocent people.

I guess it's getting harder to take that .cd domain down and there's no direct response in this thread by eXch's official team, and their account hasn't been online since 5th of May. I don't think that we're going to get rewarded for the rest of the suspended domains, however I guess we already got enough knowledge and awareness to report scam/phishing sites and I believe from here on if possible we should create a group or a small community to help support all businesses that  have been affected by the scammers who create phishing sites.

[JoseJosayyyy]

Did eXch somehow leak the list of emails that participated in this?

2 of the 3 emails that I'd set up just to make complaints for this bounty, have been FLOODED with child porn images, and receipts from "darknet child porno" sites that I didn't sign up for. Also a bunch of shit about FBI tips regarding me being involved in CP.

I'm not American and these aren't my real emails, and obviously only idiots think eXch is ever going to return here and pay more bounties, so I'm not to worried. I'm curious if this is also is happening to the rest of you.

For some reason the 3rd email I used didn't get anything like this.

[joker_josue]

Did eXch somehow leak the list of emails that participated in this?

2 of the 3 emails that I'd set up just to make complaints for this bounty, have been FLOODED with child porn images, and receipts from "darknet child porno" sites that I didn't sign up for. Also a bunch of shit about FBI tips regarding me being involved in CP.

I'm not American and these aren't my real emails, and obviously only idiots think eXch is ever going to return here and pay more bounties, so I'm not to worried. I'm curious if this is also is happening to the rest of you.

For some reason the 3rd email I used didn't get anything like this.

In addition to having created 20 emails, how many accounts here on the forum do you have, to invent stories about this campaign and against the eXch team?

[Pmalek]

If you guys haven't noticed, monero(.)forex is back online again. Cockroach mentality.

[Haunebu]

If you guys haven't noticed, monero(.)forex is back online again. Cockroach mentality.

German cockroaches to be more specific. Darknet is fine too along with Exch.cd. Guess those dumdums don't really know when to give up.

[examplens]

If you guys haven't noticed, monero(.)forex is back online again. Cockroach mentality.

German cockroaches to be more specific. Darknet is fine too along with Exch.cd. Guess those dumdums don't really know when to give up.

A shady provider like 1api.net lacks the authority or courage to take any measures against scammers. The complete lack of online support shows how serious the provider is, they did not deign to respond to anyone's report. At the same time, they seem to be only a part of the company teaminternet.com
Anyway, I think reports should be taken to someone in charge who has more authority

[Trêvoid]

https://bitcointalk.org/index.php?topic=5545167.new#new

A new fraudulent website, exch2.cx, has emerged!

[PX-Z]

https://bitcointalk.org/index.php?topic=5545167.new#new

A new fraudulent website, exch2.cx, has emerged!

It uses the same domain name, but the site looks completely different and now functions as an exchange. Starting a business with a domain name that's almost identical to another is already quite suspicious. Probably its a scam, but should not be considered as phishing website.