6 ms·

Hi Ted - can you speak to Namecheap's stance on bulk spam domain registrations and the fact that Namecheap does nothing to stop it? There has been (at least in

Hi Ted - can you speak to Namecheap's stance on bulk spam domain registrations and the fact that Namecheap does nothing to stop it? There has been (at least in the Bay Area) a large increase in text spam. They all have a very similar format, e.g. pretending you missed a delivery, and try to get you to click on a link, usually a .info domain. They are all hosted on Alibaba Cloud, but they are registered in bulk via Namecheap. Your legal and abuse team says they have no obligation to prevent such registrations, but to instead take it up with the FTC or the hosting, both of which do nothing either. Here's a recent article about the problem with bulk registrations and spam: https://www.spamhaus.org/news/article/795/weaponizing-domain-names-how-bulk-registration-aids-global-spam-campaigns https://www.spamhaus.org/news/article/795/weaponizing-domain... edit: I highly recommend reading the article for more context on why bulk domain registration is problematic. Note the DOJ filed a temporary restraining order again Namecheap, and the office of the NY AG also contacted them due to their role in spam and scams. To address some of the questions and comments below: > A registrar is simple: request a domain, they check you match the requirement for said domain rules, take your money and register the domain for you. Very simple, very stupid, very non-opiniated. Where do you draw the line on this? How do you feel about registering hate speech in a domain name, or someone else's trademark? Clearly there needs to be some level of regulation. > do they have any obligation to investigate the purouse people want to use the domains for Do domain hosts have any obligation to investigate what people are hosting? Does Google have an obligation to remove results from search? There are clearly multiple parties to hosting content on the web, and it's a shared responsibility to keep folks doing the right thing > Are you asking Namecheap to take unilateral action against domain registrations with no due process? No - what makes you think that's what I was asking?

toomuchtodo 6y ago
Are you asking Namecheap to take unilateral action against domain registrations with no due process? As a Namecheap customer, I do not support such behavior, nor is it their mandate as a registrar. If the problem is with mobile provider spam filtering and where the sites are hosted, that is where the abuse issue should be dealt with, with continued complaints to regulatory bodies (ie, the FTC and the FCC).
proto-n 6y ago
Well, do they have any obligation to investigate the purouse people want to use the domains for?
Simulacra 6y ago
I’m interested to hear a response to this too instead of a sales pitch.
kevin_thibedeau 6y ago
I'm getting a lot of text spam from what look like hacked cell phones. Someone in the phone industry should get off their bottoms and do something about customers sending out unusual volumes of SMS.
thefounder 6y ago
Yeah, let's make the domain registries another walled garden! Then start whining when they suspend your supid game or whatever they don't like about your website/business(i.e an abusive DMCA report)
MiroF 6y ago
I'm somewhat surprised AlibabaCloud wouldn't act on it. The others, not so much - nor do I think namecheap has an obligation to do so.
ted0 6y ago
Thanks for the question. I can assure you that our legal and abuse team do their very best to address bad actors. In fact, they are one of the hardest working teams in the company. We put a lot of time and due diligence into each case and do not takedown domains without sufficient evidence. We believe that taking domains down without proper cause can be a slippery slope.
- vorpalhex 6y ago
  I reported a spam domain to namecheap, including a police case file, full emails, and basically everything except a bank statement after my elderly parent was taken for a (several thousand dollar) scam. Namecheap never resolved it or even responded back beyond the precanned message.
  - lopmotr 6y ago
    Isn't it the police's job to be seizing property from criminals to prevent crime? Not individual victims. If the police won't demand Namecheap remove it, then sorry? They don't have to. It's not like Namecheap committed the fraud any more than a carmaker robbed a bank because the robber drove away in their car.
    - gowld 6y ago
      Usually if someone is using your property for crime, you have an obligation to stop it. Don't know if it applies in this particular case though. Clearly the government didn't think so.
      - geocrasher 6y ago
        This is the very reason that Safe Harbor laws are in place for these industries.
        vorpalhex 6y ago
        Safe harbor laws only apply when you reasonably don't know or couldn't know about the illegal behavior. Once you become aware of it then safe harbor no longer applies.
nolok 6y ago
You really, really don't want registrars to enter that game. A registrar is simple: request a domain, they check you match the requirement for said domain rules, take your money and register the domain for you. Very simple, very stupid, very non-opiniated. If registrars start deciding who is worthy of domains, what arbitrary set of rules they want you to follow on top of the real ones, what set of laws they act as judge for ... Things would go wrong insanely quickly. If the price of that is that they let abusers through too then fine, they're not the justice department either way and if they apply the judicial decision once those abusers are caught, that's all we should ask from them.
- shiftpgdn 6y ago
  Registrars already deal with abuse complaints (and have done so since the 90s.) GoDaddy, eNom and other large registrars are happy to suspend domains with proof of network abuse.
PhilosAccnting 6y ago
The trouble with free speech is that it hurts people who get hit by it (e.g., scams, defamation/slander/libel, intrusive advertising). The trouble with regulating speech is that the regulators have become a type of autocratic judge presiding over the decision. The only cure to allow regulation AND autocracy would require some level of distribution of power. We've seen councils of industry leaders before, and this may be a good chance for an enterprising NPOer (NPOneur? NPOinator?).
timdev2 6y ago
> How do you feel about registering hate speech in a domain name, or someone else's trademark? In the US, all kinds of speech is "awful but lawful", including hate speech. I don't think registrars should be policing legal speech. If there's trademark infringement going on, there are legal processes to which the injured parties can avail themselves. If there's more serious criminality afoot, law enforcement should generally lead. I don't like the idea of unpopular but legal speech being scrubbed from the public internet because people object loudly to it. I think domain registrars (and other infrastructure vendors) are qualitatively different than social media properties, etc, in this regard.
- timcederman 6y ago
  It's not a legal requirement for them (AFAIK) to make decisions on allowing someone to register a domain or not. They're a private business, so my argument is it's (probably) in their best interest to not upset their customers and partners. There are plenty of examples of limits on almost all registrars, and I was curious why they have such a hands-off stance on bulk registrations very clearly being used for illegal activities. Ted's answer gives me partial insight, but my takeaway is not enough damage, legal risk, or people complaining to say no to the money.

toomuchtodo 6y ago

Are you asking Namecheap to take unilateral action against domain registrations with no due process? As a Namecheap customer, I do not support such behavior, nor is it their mandate as a registrar. If the problem is with mobile provider spam filtering and where the sites are hosted, that is where the abuse issue should be dealt with, with continued complaints to regulatory bodies (ie, the FTC and the FCC).

proto-n 6y ago

Well, do they have any obligation to investigate the purouse people want to use the domains for?

Simulacra 6y ago

I’m interested to hear a response to this too instead of a sales pitch.

kevin_thibedeau 6y ago

I'm getting a lot of text spam from what look like hacked cell phones. Someone in the phone industry should get off their bottoms and do something about customers sending out unusual volumes of SMS.

thefounder 6y ago

Yeah, let's make the domain registries another walled garden! Then start whining when they suspend your supid game or whatever they don't like about your website/business(i.e an abusive DMCA report)

MiroF 6y ago

I'm somewhat surprised AlibabaCloud wouldn't act on it. The others, not so much - nor do I think namecheap has an obligation to do so.

ted0 6y ago

Thanks for the question. I can assure you that our legal and abuse team do their very best to address bad actors. In fact, they are one of the hardest working teams in the company. We put a lot of time and due diligence into each case and do not takedown domains without sufficient evidence. We believe that taking domains down without proper cause can be a slippery slope.

vorpalhex 6y ago
I reported a spam domain to namecheap, including a police case file, full emails, and basically everything except a bank statement after my elderly parent was taken for a (several thousand dollar) scam. Namecheap never resolved it or even responded back beyond the precanned message.
- lopmotr 6y ago
  Isn't it the police's job to be seizing property from criminals to prevent crime? Not individual victims. If the police won't demand Namecheap remove it, then sorry? They don't have to. It's not like Namecheap committed the fraud any more than a carmaker robbed a bank because the robber drove away in their car.
  - gowld 6y ago
    Usually if someone is using your property for crime, you have an obligation to stop it. Don't know if it applies in this particular case though. Clearly the government didn't think so.
    - geocrasher 6y ago
      This is the very reason that Safe Harbor laws are in place for these industries.
      - vorpalhex 6y ago
        Safe harbor laws only apply when you reasonably don't know or couldn't know about the illegal behavior. Once you become aware of it then safe harbor no longer applies.

nolok 6y ago

You really, really don't want registrars to enter that game. A registrar is simple: request a domain, they check you match the requirement for said domain rules, take your money and register the domain for you. Very simple, very stupid, very non-opiniated. If registrars start deciding who is worthy of domains, what arbitrary set of rules they want you to follow on top of the real ones, what set of laws they act as judge for ... Things would go wrong insanely quickly. If the price of that is that they let abusers through too then fine, they're not the justice department either way and if they apply the judicial decision once those abusers are caught, that's all we should ask from them.

shiftpgdn 6y ago
Registrars already deal with abuse complaints (and have done so since the 90s.) GoDaddy, eNom and other large registrars are happy to suspend domains with proof of network abuse.

PhilosAccnting 6y ago

The trouble with free speech is that it hurts people who get hit by it (e.g., scams, defamation/slander/libel, intrusive advertising). The trouble with regulating speech is that the regulators have become a type of autocratic judge presiding over the decision. The only cure to allow regulation AND autocracy would require some level of distribution of power. We've seen councils of industry leaders before, and this may be a good chance for an enterprising NPOer (NPOneur? NPOinator?).

timdev2 6y ago

> How do you feel about registering hate speech in a domain name, or someone else's trademark? In the US, all kinds of speech is "awful but lawful", including hate speech. I don't think registrars should be policing legal speech. If there's trademark infringement going on, there are legal processes to which the injured parties can avail themselves. If there's more serious criminality afoot, law enforcement should generally lead. I don't like the idea of unpopular but legal speech being scrubbed from the public internet because people object loudly to it. I think domain registrars (and other infrastructure vendors) are qualitatively different than social media properties, etc, in this regard.

timcederman 6y ago
It's not a legal requirement for them (AFAIK) to make decisions on allowing someone to register a domain or not. They're a private business, so my argument is it's (probably) in their best interest to not upset their customers and partners. There are plenty of examples of limits on almost all registrars, and I was curious why they have such a hands-off stance on bulk registrations very clearly being used for illegal activities. Ted's answer gives me partial insight, but my takeaway is not enough damage, legal risk, or people complaining to say no to the money.