I haven't read the whole thread so I'm sorry if this already has been brought up.

But [Suspicious link removed] may be continuing to link to phishing exchanges. I see that they now link to stealthex[dot]co. But the first google entry if you enter "stealthex" is actually stealthex[dot]io. The .io version is also linked on kycnot.me: [1]

I also suspect a bit about xchange[dot]cx. There is an exchange called xchange.me linked also on kycnot.me [2] but it seems the "cx" exchange is the first google entry now.

---

[1] https://kycnot.me/service/stealthex
[2] https://kycnot.me/service/xchange-me