Detailed evidence exposing the darknetbible.info and monero.forex scam network. Fake Monero swap services, phishing sites, and threats against whistleblowers documented. Stay safe and informed.
This page documents clear evidence of a crypto-related scam involving two interconnected domains:
darknetbible[.]info and monero[.]forex.
Both websites falsely present themselves as trustworthy sources of information about the Monero cryptocurrency. However, when discussing how to “swap Monero,” they directly lead users to phishing sites that impersonate legitimate cryptocurrency services.
The sites are most likely operated by the same individual or a coordinated group.
DarknetBible[.]info: A Copycat Site
The domain darknetbible[.]info is a near-identical copy of the original DNM Bible onion site, which is officially verified and listed on tor.taxi.
This deceptive tactic aims to establish false credibility while secretly directing users to malicious links.
The real DNM Bible onion is: http://biblemeowimkh3utujmhm6oh2oeb3ubjw2lpgeq3lahrfr2l6ev6zgyd.onion/
Deceptive Tactics Behind darknetbible[.]info and monero[.]forex
Previously, they used phishing domain exch[.]cash (IP: 185.156.46.121, hosted via Serverius), an identical copy of exch.net. After reporting it to the registrar easyDNS and upstream provider Tucows, DNS records were suspended (WHOIS status: “clientHold”).
Screenshot from web ahrchive showing links to fake websites xchange[.]sbs and exch[.]cash, which impersonate the legitimate domains xchange.me and exch.net.
Web Archive 26 Jan. ’25
monero[.]forex: This domain presents itself as a platform for information about the Monero currency, but similar to darknebible[.]info, it contains links to phishing sites that mimic legitimate exchange platforms, including copies of xchange.me.
monero[.]forex also refers visitors to phishing sites. For clearnet site as well as for onion.
Web Archive 31 March. ’25
Both domains were initially registered with Namecheap. After many reports and contact with Namecheap, they claimed insufficient resources to fully investigate the case. Consequently, the site namecheapscamexpose.info was created to document all evidence. To evade sanctions, the scammer transferred darknebible[.]info to easyDNS and monero[.]forex to 1API.net.
Some of the domains are already red flagged.
This advisory was issued based on data from Google Safe Browsing, indicating the domain is flagged for phishing or other malicious activity.
Additionally, the site promotes the phishing domain exch[.]best as if it were a legitimate platform.
another revealing proof of how the domain is part of the scheme
https://whoisfreaks.com/tools/whois/history/lookup/monero.forex
The difference between an original and a fake site is hard to see for those who don’t know
The original eXch contains its domains exch.net and exch.cx as well as the original onion link
The scammer has only kept the exch[.]best domain and a link to a fake onion site active. (otherwise, the domain is marked as “dangerous”)
Disappearance of Fake Exchange Links
Initially, significant pressure was applied regarding phishing links imitating cryptocurrency services, such as fake versions of exch.net and xchange.me.
Facing exposure, the scammer attempted to erase evidence by removing all references to the compromised exchange (exch) from his sites and online profiles.
However, the dangerous phishing Monero swap links remain active, and the fake pages still attempt to lure unsuspecting users.
Blackmail
(this is proof from the official eXch representative on the forum)
Who is Trevor Baaddi?
Threats
