5 ms·

Casual reminder that 9/10 phishing scam domains you come across will be hosted on NameCheap and the company couldn't care less, probably too valuable as revenue

Casual reminder that 9/10 phishing scam domains you come across will be hosted on NameCheap and the company couldn't care less, probably too valuable as revenue. This is so well known that blackhat discussions recommend NameCheap as the registrar of choice. Maybe they exploit vulnerabilities like this one. If the CTO or CEO or whatever C-level comes on here to do damage control every now and then tries to disagree (probably citing how big their $3/hour Eastern European legal team is) keep in mind it's all PR junk and the proof is in the pudding. It's been years -- no action, no change. Just more scams.

hoffs 4y ago
> couldn't care less They are usually praised for how fast they take down phishing domains though
- deleted 4y ago
  [deleted]
- someotherperson 4y ago
  They'll take down a single domain and pretend to not know how to take down the other 300 registered on the same user's account. The argument that NameCheap (and its supporters) provide is that this is a good thing that makes them stay because NameCheap shouldn't be policing domains or some other free speech nonsense ignoring that this is pure facilitation of crime. Ignoring that this is blatantly violating their own T&Cs and the ICANN guidelines.
  - AndriyKunitsyn 4y ago
    So they actually do care, huh. No, the argument is it's either this "free speech nonsense" or gestapo filtration like the Apple's/Google's app review process, where the big company is the judge and the jury, and I prefer the former.
    - desindol 4y ago
      Ah yes the nazi hammer.
- user8139471 4y ago
  Not my experience. I tried their abuse email address, their abuse report form and I even made an account to contact support, but did not even receive a reply. Over 30 websites are still up. But to be fair, the websites are about selling certain pills and not about phishing.
- jabo 4y ago
  Not in my experience either. I received phishing (physical) mail [1] pointing me to a domain that was registered with namecheap. I reported it to them in March, I followed up a few months later, and I still see the website operating today, with no response from namecheap. The domain is even listed on the USPTO site as a scam operation [2], yet no action has been taken yet. [1] Looks like this: https://www.uspto.gov/sites/default/files/documents/WTP%20Trademark%20Publication%20%28NY%29%20%28redacted%29_Redacted.pdf https://www.uspto.gov/sites/default/files/documents/WTP%20Tr... [2] https://www.uspto.gov/trademarks/protect/caution-misleading-notices https://www.uspto.gov/trademarks/protect/caution-misleading-...
SyneRyder 4y ago
Do you have some more supporting evidence for this, without me having to waltz into a blackhat forum? I'm not trying to be the "citation needed" guy, but as someone who regularly reports internet abuse to blacklists (and is sick of all the attacks that "neutral" places like Cloudflare send to my sites), I'd like to know more. I've seen your previous 2020 HN submission on this about Namecheap hosting the domains used in SMS scams: https://news.ycombinator.com/item?id=24231307 https://news.ycombinator.com/item?id=24231307
- 323 4y ago
  > 2020: UK National Cyber Security Centre: Figure 1 shows that NameCheap became the most popular host of UK government-themed phishing during 2020. By December 2020 we found that it hosted in excess of 60% of phishing in this category. https://shkspr.mobi/blog/2021/05/why-do-scammers-love-namecheap/ https://shkspr.mobi/blog/2021/05/why-do-scammers-love-namech... https://www.ncsc.gov.uk/files/Active-Cyber-Defence-ACD-The-Fourth-Year.pdf https://www.ncsc.gov.uk/files/Active-Cyber-Defence-ACD-The-F... > 2017: As of today around 38% of the domains reported to us since we began recording on 8/23/17 are sponsored by NameCheap INC. These domains are allowed to continue to scam consumers long after they are reported. An example of this is “ecojetexpress.us” which has been reported repeatedly by both petscams.com and victims who have lost money. When victims of this scam filed an abuse report NameCheap did not “take reasonable and prompt steps to investigate”. Instead they forwarded the abuse report with the victims information to the criminal. 5 months later, ecojetexpress.us was still online scamming new victims. https://petscams.com/news/namecheap-hurting-internet/ https://petscams.com/news/namecheap-hurting-internet/ > Facebook sues Namecheap to unmask hackers who registered malicious domains. The social networking giant claims that Namecheap has refused to cooperate in an investigation into a series of malicious domains that have been registered through its service and which impersonated the Facebook brand. > Some of the sample domains included the likes of instagrambusinesshelp.com, facebo0k-login.com, and whatsappdownload.site. > Dubois said lookalike domains like these -- which abuse the Facebook brand -- are often used for phishing, fraud, and scams. https://www.zdnet.com/article/facebook-sues-namecheap-to-unmask-hackers-who-registered-malicious-domains/ https://www.zdnet.com/article/facebook-sues-namecheap-to-unm...
Avamander 4y ago
Then again you can create heuristics that block suspicious domains registered at NameCheap, silver lining or something. I really wish the effort put into curtailing piracy went into curtailing spam and phishing instead. Would be actually beneficial to society.

hoffs 4y ago

> couldn't care less They are usually praised for how fast they take down phishing domains though

deleted 4y ago
[deleted]
someotherperson 4y ago
They'll take down a single domain and pretend to not know how to take down the other 300 registered on the same user's account. The argument that NameCheap (and its supporters) provide is that this is a good thing that makes them stay because NameCheap shouldn't be policing domains or some other free speech nonsense ignoring that this is pure facilitation of crime. Ignoring that this is blatantly violating their own T&Cs and the ICANN guidelines.
- AndriyKunitsyn 4y ago
  So they actually do care, huh. No, the argument is it's either this "free speech nonsense" or gestapo filtration like the Apple's/Google's app review process, where the big company is the judge and the jury, and I prefer the former.
  - desindol 4y ago
    Ah yes the nazi hammer.
user8139471 4y ago
Not my experience. I tried their abuse email address, their abuse report form and I even made an account to contact support, but did not even receive a reply. Over 30 websites are still up. But to be fair, the websites are about selling certain pills and not about phishing.
jabo 4y ago
Not in my experience either. I received phishing (physical) mail [1] pointing me to a domain that was registered with namecheap. I reported it to them in March, I followed up a few months later, and I still see the website operating today, with no response from namecheap. The domain is even listed on the USPTO site as a scam operation [2], yet no action has been taken yet. [1] Looks like this: https://www.uspto.gov/sites/default/files/documents/WTP%20Trademark%20Publication%20%28NY%29%20%28redacted%29_Redacted.pdf https://www.uspto.gov/sites/default/files/documents/WTP%20Tr... [2] https://www.uspto.gov/trademarks/protect/caution-misleading-notices https://www.uspto.gov/trademarks/protect/caution-misleading-...

SyneRyder 4y ago

Do you have some more supporting evidence for this, without me having to waltz into a blackhat forum? I'm not trying to be the "citation needed" guy, but as someone who regularly reports internet abuse to blacklists (and is sick of all the attacks that "neutral" places like Cloudflare send to my sites), I'd like to know more. I've seen your previous 2020 HN submission on this about Namecheap hosting the domains used in SMS scams: https://news.ycombinator.com/item?id=24231307 https://news.ycombinator.com/item?id=24231307

323 4y ago
> 2020: UK National Cyber Security Centre: Figure 1 shows that NameCheap became the most popular host of UK government-themed phishing during 2020. By December 2020 we found that it hosted in excess of 60% of phishing in this category. https://shkspr.mobi/blog/2021/05/why-do-scammers-love-namecheap/ https://shkspr.mobi/blog/2021/05/why-do-scammers-love-namech... https://www.ncsc.gov.uk/files/Active-Cyber-Defence-ACD-The-Fourth-Year.pdf https://www.ncsc.gov.uk/files/Active-Cyber-Defence-ACD-The-F... > 2017: As of today around 38% of the domains reported to us since we began recording on 8/23/17 are sponsored by NameCheap INC. These domains are allowed to continue to scam consumers long after they are reported. An example of this is “ecojetexpress.us” which has been reported repeatedly by both petscams.com and victims who have lost money. When victims of this scam filed an abuse report NameCheap did not “take reasonable and prompt steps to investigate”. Instead they forwarded the abuse report with the victims information to the criminal. 5 months later, ecojetexpress.us was still online scamming new victims. https://petscams.com/news/namecheap-hurting-internet/ https://petscams.com/news/namecheap-hurting-internet/ > Facebook sues Namecheap to unmask hackers who registered malicious domains. The social networking giant claims that Namecheap has refused to cooperate in an investigation into a series of malicious domains that have been registered through its service and which impersonated the Facebook brand. > Some of the sample domains included the likes of instagrambusinesshelp.com, facebo0k-login.com, and whatsappdownload.site. > Dubois said lookalike domains like these -- which abuse the Facebook brand -- are often used for phishing, fraud, and scams. https://www.zdnet.com/article/facebook-sues-namecheap-to-unmask-hackers-who-registered-malicious-domains/ https://www.zdnet.com/article/facebook-sues-namecheap-to-unm...

Avamander 4y ago

Then again you can create heuristics that block suspicious domains registered at NameCheap, silver lining or something. I really wish the effort put into curtailing piracy went into curtailing spam and phishing instead. Would be actually beneficial to society.