I haven't read the whole thread so I'm sorry if this already has been brought up.

But monero.forex may be continuing to link to phishing exchanges. I see that they now link to stealthex[dot]co. But the first google entry if you enter "stealthex" is actually stealthex[dot]io.

I also suspect a bit about xchange[dot]cx. There is an exchange called xchange.me (link goes to kycnot.me) but indeed the "cx" exchange is the first google entry now.