Warning: Darknetbible[.]info and Monero[.]forex Scam Network Exposed

Web Archive 26 Jan. ’25 

monero[.]forex: This domain presents itself as a platform for information about the Monero currency, but similar to darknebible[.]info, it contains links to phishing sites that mimic legitimate exchange platforms, including copies of xchange.me.

Web Archive 31 March. ’25 

Both domains were initially registered with Namecheap. After many reports and contact with Namecheap, they claimed insufficient resources to fully investigate the case. Consequently, the site namecheapscamexpose.info was created to document all evidence. To evade sanctions, the scammer transferred darknebible[.]info to easyDNS and monero[.]forex to 1API.net.

Some of the domains are already red flagged.

ebred
The browser (Firefox) blocked access to exch[.]best, displaying a warning message: “Deceptive site ahead.”
This advisory was issued based on data from Google Safe Browsing, indicating the domain is flagged for phishing or other malicious activity.
mfred
MetaMask has flagged the domain monero[.]forex as potentially deceptive, warning that attackers may try to trick users into performing unsafe actions.
Additionally, the site promotes the phishing domain exch[.]best as if it were a legitimate platform.

https://whoisfreaks.com/tools/whois/history/lookup/monero.forex

The difference between an original and a fake site is hard to see for those who don’t know

The original eXch contains its domains exch.net and exch.cx as well as the original onion link
The scammer has only kept the exch[.]best domain and a link to a fake onion site active. (otherwise, the domain is marked as “dangerous”)

Disappearance of Fake Exchange Links

Initially, significant pressure was applied regarding phishing links imitating cryptocurrency services, such as fake versions of exch.net and xchange.me.
Facing exposure, the scammer attempted to erase evidence by removing all references to the compromised exchange (exch) from his sites and online profiles.

However, the dangerous phishing Monero swap links remain active, and the fake pages still attempt to lure unsuspecting users.

Blackmail

blackmail-btt.png-1054x576
A user under the name TrevorBaaddi registered on the Bitcointalk forum with the apparent intention of blackmailing eXch—demanding 2 BTC in exchange for handing over all domains and accounts associated with the exch phishing operation.
(this is proof from the official eXch representative on the forum)

Who is Trevor Baaddi?

Threats

download (1)
After launching the website namecheapscamexpose.info and sharing it publicly on the X platform, I personally received threats via a private message on the Bitcointalk.org forum

Share this article!