Quote from: Pmalek on Today at 07:56:56 AM

Quote from: joker_josue on Today at 07:49:12 AM

To try to be more efficient, we have to go after these two domains:
xchange[.]cx
stealthex[.]co

They are the new element of the scheme, and for that they have to be overthrown.

They can easily be replaced with other phishing websites just like they removed the eXch phishing site from there. It's the same group that operates the phishing sites and these 'news sites' driving traffic to them. Plus, they are not the focus of this campaign. The xchange and stealthex teams can deal with that if they see fit. xchange seems more willing to do something.

But it's always like this in phishing schemes, the domain is closed and they open others. It's part of it. Unless you can get clearer proof that the owner of a domain that is just releasing information, with a domain that is phishing, it will be difficult to take it down.

I'll give you a very simple example - perhaps many haven't lived through that time - Torrent sites.
There is nothing wrong with the torrent site itself, most of them just list links to a file (movie, music, book, etc.). The content is not hosted by the site, the site owner, nor does he create any torrent file. Usually it is users who share this torrent of the content you have.

For this simple reason, large companies in the music and film industries have always had great difficulty in shutting down these sites. They have had to resort to various authorities, courts and other means to get them shut down. Even so, they have only managed to shut down a few of the big ones.

And why did they take so long and only manage to go after the big ones? Well, because in reality the torrent site didn't have anything illegal. It just has links, which allow you to obtain data/files that other people have on their computer. In the midst of all this content, there are legal things and "allegedly" illegal things.

Thinking about this example, it's the same in this case. These two domains in particular do something more or less similar. Their content is not illegal, one shares "news" and the other has a set of "tutorials". You will say that they point to links from fake websites. Yes, it is true. But unless it is proven - very clearly and unsettlingly - that both projects are from the same person. It will be difficult to take them down.

Unfortunately, although it may seem obvious to us, these companies have to work with more than the obvious. They have to have irrefutable foundations, and in this area, unfortunately we are unable to provide them. This would only be possible with a clear leak of information, or a more in-depth investigation by the authorities.

I think we already have very little room to maneuver to do what we want. All that's left is to report that these sites are phishing, and VPNs, browsers and the like, do their job of blocking them (which is more or less working). But, there is no clear evidence, the owner of these sites can refute the accusations and everything goes back to normal. Sad

Thinking about this example, it is the same in this case.