After reading what you wrote, I have realized the reason the other four domains went down eadier was because these (exch[.]center, exch[.]cc, exch[.]live, exch[.]cash ) were directly involved in the phishing, but for the remaining domains the approach has to change as these are more of the affiliate business front (indirect scamming) and so the registrar will find it difficult to take them down.