Hacker News Reader

Comment by someotherperson | Hacker News Reader

Casual reminder that 9/10 phishing scam domains you come across will be hosted on NameCheap and the company couldn't care less, probably too valuable as revenue. This is so well known that blackhat discussions recommend NameCheap as the registrar of choice. Maybe they exploit vulnerabilities like this one.

If the CTO or CEO or whatever C-level comes on here to do damage control every now and then tries to disagree (probably citing how big their $3/hour Eastern European legal team is) keep in mind it's all PR junk and the proof is in the pudding. It's been years -- no action, no change. Just more scams.

View on HN

Do you have some more supporting evidence for this, without me having to waltz into a blackhat forum? I'm not trying to be the "citation needed" guy, but as someone who regularly reports internet abuse to blacklists (and is sick of all the attacks that "neutral" places like Cloudflare send to my sites), I'd like to know more.

I've seen your previous 2020 HN submission on this about Namecheap hosting the domains used in SMS scams: https://news.ycombinator.com/item?id=24231307

> 2020: UK National Cyber Security Centre: Figure 1 shows that NameCheap became the most popular host of UK government-themed phishing during 2020. By December 2020 we found that it hosted in excess of 60% of phishing in this category.

https://shkspr.mobi/blog/2021/05/why-do-scammers-love-namech...

https://www.ncsc.gov.uk/files/Active-Cyber-Defence-ACD-The-F...

> 2017: As of today around 38% of the domains reported to us since we began recording on 8/23/17 are sponsored by NameCheap INC. These domains are allowed to continue to scam consumers long after they are reported. An example of this is “ecojetexpress.us” which has been reported repeatedly by both petscams.com and victims who have lost money. When victims of this scam filed an abuse report NameCheap did not “take reasonable and prompt steps to investigate”. Instead they forwarded the abuse report with the victims information to the criminal. 5 months later, ecojetexpress.us was still online scamming new victims.

https://petscams.com/news/namecheap-hurting-internet/

> Facebook sues Namecheap to unmask hackers who registered malicious domains. The social networking giant claims that Namecheap has refused to cooperate in an investigation into a series of malicious domains that have been registered through its service and which impersonated the Facebook brand.

> Some of the sample domains included the likes of instagrambusinesshelp.com, facebo0k-login.com, and whatsappdownload.site.

> Dubois said lookalike domains like these -- which abuse the Facebook brand -- are often used for phishing, fraud, and scams.

https://www.zdnet.com/article/facebook-sues-namecheap-to-unm...

Wow, thank you very much for this. I honestly wasn't aware of any of it.

And double-Wow on that first PDF published by GCHQ. (Pages 8 and 9 are specifically their data on Namecheap as the #1 phishing threat, for anyone else wanting to read it). That's astonishingly bad performance from Namecheap. The data in that PDF is very useful with my own anti-botnet research. I bet the GCHQ data will be persuasive if I do bring this up with politicians considering removing the Safe Harbour provisions for hosts.

Then again you can create heuristics that block suspicious domains registered at NameCheap, silver lining or something.

I really wish the effort put into curtailing piracy went into curtailing spam and phishing instead. Would be actually beneficial to society.

> couldn't care less

They are usually praised for how fast they take down phishing domains though

They'll take down a single domain and pretend to not know how to take down the other 300 registered on the same user's account.

The argument that NameCheap (and its supporters) provide is that this is a good thing that makes them stay because NameCheap shouldn't be policing domains or some other free speech nonsense ignoring that this is pure facilitation of crime. Ignoring that this is blatantly violating their own T&Cs and the ICANN guidelines.

So they actually do care, huh.

No, the argument is it's either this "free speech nonsense" or gestapo filtration like the Apple's/Google's app review process, where the big company is the judge and the jury, and I prefer the former.

Ah yes the nazi hammer.

Not my experience. I tried their abuse email address, their abuse report form and I even made an account to contact support, but did not even receive a reply. Over 30 websites are still up. But to be fair, the websites are about selling certain pills and not about phishing.

Not in my experience either. I received phishing (physical) mail [1] pointing me to a domain that was registered with namecheap. I reported it to them in March, I followed up a few months later, and I still see the website operating today, with no response from namecheap.

The domain is even listed on the USPTO site as a scam operation [2], yet no action has been taken yet.

[1] Looks like this: https://www.uspto.gov/sites/default/files/documents/WTP%20Tr...

[2] https://www.uspto.gov/trademarks/protect/caution-misleading-...

Reply on news.ycombinator.com