Next scheduled rescrape ... never
Version 2
Last scraped
Scraped on 12/04/2025, 11:08:08 UTC
monero[.]forex
In this case, looking at the website's content, what we see is a "news portal" - probably fake, as I didn't even check it. So saying that it is a scam and against the real "eXch" may not make sense. In this case, the approach has to be different, we have to look for evidence that he is spreading phishing and creating scams. The only indication that leads to eXch (that I found) is a link they have to a certain "exch[.]best". Shouldn't we be going after that domain?
In this case, looking at the website's content, what we see is a "news portal" - probably fake, as I didn't even check it. So saying that it is a scam and against the real "eXch" may not make sense. In this case, the approach has to be different, we have to look for evidence that he is spreading phishing and creating scams. The only indication that leads to eXch (that I found) is a link they have to a certain "exch[.]best". Shouldn't we be going after that domain?
Yes that's possible, but there's no denying that they updated the link to Exch's phishing website likely after the registrar suspended the domain 'exch[.]cash'
Latest archive from the Wayback Machine 'March 13, 2025'
The phishing domain 'exch[.]cash' was suspended on '25th March, 2025', and now when you open this '.forex' website, you'll see the domain has been updated to '.best' for Exch's phishing website.
All of it happened recently, and likely within a week or two of the '.cash' domain getting suspended, so there's a good chance '.forex' is targeting exch specifically (Could be a coincidence too, not denying your possibility as well.
If this is the case, then whoever is phishing Exch is likely the owner of the '.forex' domain, or in close contact with the owner of the '.forex' domain. (That's what I think).
This is the key point, which you can adjust to solve the issue.
Does anyone remember receiving any notification about when "exch[.]cash" was suspended? This can be useful to show the domain registrar that the owner of the . forex is using the site for scam and phishing. If anyone has it and can share it, I would appreciate it.
When I sent a recent email to the Namecheap '.forex' domain, I included this key point, along with an archive for them to look at. I don't know the exact procedures registrars follow when suspending a domain, but this '.forex' domain is in the grey zone as far as I can tell. (They're not directly hosting the phishing website, which is what keeps them alive for this long, I can tell.)
I received an email from Tucows after the '.cash' domain was suspended.
I've just received an email from Tucows, they mentioned 'this was a result of Tucows' investigation!'
Version 1
Scraped on 05/04/2025, 11:13:12 UTC
monero[.]forex
In this case, looking at the website's content, what we see is a "news portal" - probably fake, as I didn't even check it. So saying that it is a scam and against the real "eXch" may not make sense. In this case, the approach has to be different, we have to look for evidence that he is spreading phishing and creating scams. The only indication that leads to eXch (that I found) is a link they have to a certain "exch[.]best". Shouldn't we be going after that domain?
In this case, looking at the website's content, what we see is a "news portal" - probably fake, as I didn't even check it. So saying that it is a scam and against the real "eXch" may not make sense. In this case, the approach has to be different, we have to look for evidence that he is spreading phishing and creating scams. The only indication that leads to eXch (that I found) is a link they have to a certain "exch[.]best". Shouldn't we be going after that domain?
Yes that's possible, but there's no denying that they updated the link to Exch's phishing website likely after the registrar suspended the domain 'exch[.]cash'
Latest archive from the Wayback Machine 'March 13, 2025'
The phishing domain 'exch[.]cash' was suspended on '25th March, 2025', and now when you open this '.forex' website, you'll see the domain has been updated to '.best' for Exch's phishing website.
All of it happened recently, and likely within a week or two of the '.cash' domain getting suspended, so there's a good chance '.forex' is targeting exch specifically (Could be a coincidence too, not denying your possibility as well.
If this is the case, then whoever is phishing Exch is likely the owner of the '.forex' domain, or in close contact with the owner of the '.forex' domain. (That's what I think).
This is the key point, which you can adjust to solve the issue.
Does anyone remember receiving any notification about when "exch[.]cash" was suspended? This can be useful to show the domain registrar that the owner of the . forex is using the site for scam and phishing. If anyone has it and can share it, I would appreciate it.
When I sent a recent email to the Namecheap '.forex' domain, I included this key point, along with an archive for them to look at. I don't know the exact procedures registrars follow when suspending a domain, but this '.forex' domain is in the grey zone as far as I can tell. (They're not directly hosting the phishing website, which is what keeps them alive for this long, I can tell.)
I received an email from Tucows after the '.cash' domain was suspended.
I've just received an email from Tucows, they mentioned 'this was a result of Tucows' investigation!'
Original archived Re: [OPEN] eXch Anti-Phishing Campaign
Scraped on 05/04/2025, 11:08:03 UTC
monero[.]forex
In this case, looking at the website's content, what we see is a "news portal" - probably fake, as I didn't even check it. So saying that it is a scam and against the real "eXch" may not make sense. In this case, the approach has to be different, we have to look for evidence that he is spreading phishing and creating scams. The only indication that leads to eXch (that I found) is a link they have to a certain "exch[.]best". Shouldn't we be going after that domain?
In this case, looking at the website's content, what we see is a "news portal" - probably fake, as I didn't even check it. So saying that it is a scam and against the real "eXch" may not make sense. In this case, the approach has to be different, we have to look for evidence that he is spreading phishing and creating scams. The only indication that leads to eXch (that I found) is a link they have to a certain "exch[.]best". Shouldn't we be going after that domain?
Yes that's possible, but there's no denying that they updated the link to Exch's phishing website likely after the registrar suspended the domain 'exch[.]cash'
Latest archive from the Wayback Machine 'March 13, 2025'
The phishing domain 'exch[.]cash' was suspended on '25th March, 2025', and now when you open this '.forex' website, you'll see the domain has been updated to '.best' for Exch's phishing website.
All of it happened recently, and likely within a week or two of the '.cash' domain getting suspended, so there's a good chance '.forex' is targeting exch specifically (Could be a coincidence too, not denying your possibility as well.
If this is the case, then whoever is phishing Exch is likely the owner of the '.forex' domain, or in close contact with the owner of the '.forex' domain. (That's what I think).
This is the key point, which you can adjust to solve the issue.
Does anyone remember receiving any notification about when "exch[.]cash" was suspended? This can be useful to show the domain registrar that the owner of the . forex is using the site for scam and phishing. If anyone has it and can share it, I would appreciate it.
When I sent a recent email to the Namecheap '.forex' domain, I included this key point, along with an archive for them to look at. I don't know the exact procedures registrars follow when suspending a domain, but this '.forex' domain is in the grey zone as far as I can tell. (They're not directly hosting the phishing website, which is what keeps them alive for this long, I can tell.)
I received an email from Tucows after the '.cash' domain was suspended.
I've just received an email from Tucows, they mentioned 'this was a result of Tucows' investigation!'
[/quote]