In the case of monero[.]forex I think the approach now has to be to the other phishing site that they are indicating: xchange[.]cx
@examplens you should include this on your website.
I think we have entered a phase where we cannot concentrate information around eXch, we have to approach the subject in a more comprehensive way.
For takedown to happen, other websites being phished has to be mentioned.
@exch support
If you are on twitter, something to consider as advised by easyDNS.
Am sure not a free service.