monero[.]forex
In this case, looking at the website's content, what we see is a "news portal" - probably fake, as I didn't even check it. So saying that it is a scam and against the real "eXch" may not make sense. In this case, the approach has to be different, we have to look for evidence that he is spreading phishing and creating scams. The only indication that leads to eXch (that I found) is a link they have to a certain "exch[.]best". Shouldn't we be going after that domain?
Yes that's possible, but there's no denying that they updated the link to Exch's phishing website likely after the registrar suspended the domain 'exch[.]cash'
Latest archive from the Wayback Machine 'March 13, 2025'The phishing domain 'exch[.]cash' was suspended on '25th March, 2025', and now when you open this
'.forex' website, you'll see the domain has been updated to '.best' for Exch's phishing website.
All of it happened recently, and likely within a week or two of the '.cash' domain getting suspended, so there's a good chance '.forex' is targeting exch specifically (Could be a coincidence too, not denying your possibility as well.
If this is the case, then whoever is phishing Exch is likely the owner of the '.forex' domain, or in close contact with the owner of the '.forex' domain. (That's what I think).
This is the key point, which you can adjust to solve the issue.
Does anyone remember receiving any notification about when "exch[.]cash" was suspended? This can be useful to show the domain registrar that the owner of the . forex is using the site for scam and phishing. If anyone has it and can share it, I would appreciate it.