How to report a phishing site to Namecheap

How to reach them

• Include the domain, the full URLs and the real site being copied
• Back your report with concrete evidence

Reporting to Namecheap, step by step

1. Check that Namecheap is the registrar, as Namecheap itself asks: look the domain up on Namecheap's Whois lookup page or any RDAP tool and read the registrar field.
2. Write one email to [email protected]. Namecheap has no web form for this; its "Report Abuse" menu link opens its help article on filing abuse complaints.
3. List the evidence below in the email. Namecheap only accepts attachments as csv, doc, docx, eml, jpeg, jpg, pdf, png, txt, xls or xlsx, and scans them.
4. Do not report through Live Chat. Namecheap says chat staff have to pass the report to its Legal and Abuse Department, which slows it down.
5. Because Namecheap may not act on fraud it cannot verify while it is only the registrar, also report the site to whoever hosts it. Namecheap points to Google's dig tool and DomainTools whois to find the host from the IP address.
6. Reply in the same thread for any follow up, keeping the engagement ID in the subject so the Legal and Abuse Department can match your messages.

What Namecheap asks you to include

• The abusive domain names and the exact abusive URLs.
• The real website that the fake one copies, which Namecheap calls the target of the attack.
• The country your IP address is in, because Namecheap says the content may be geo-blocked and it will try a proxy from that country.
• Your device and browser, since Namecheap notes the page can change depending on device and software.
• For money scams, Namecheap also lists paid invoices or receipts, a screenshot of the page, and the email with full header and body.
• Namecheap asks you not to send malware samples or the original malicious email. Send plain-text headers, screenshots, de-fanged URLs, or links to sandbox or VirusTotal results.

What Namecheap can do

• Namecheap's Registration Agreement lets it suspend or terminate a registration for cause, including abuse of the services and material allegations of illegal conduct, and it lists phishing among banned uses.
• The same agreement lets Namecheap place a domain on registry lock, hold or a similar status, and suspend every service in the holder's account once it has grounds against one domain.
• A suspended Namecheap domain shows clientHold or serverHold in a status lookup, which Namecheap says means it is no longer available on the internet.
• Namecheap will forward your message to a privacy-protected domain holder if you write to the protected email address shown in WHOIS.

What Namecheap cannot do

• Namecheap says that when it is only the registrar and the content sits on a third party's servers, it may be unable to verify fraud, spam, malware or copyright claims, and will not restrict the domain to avoid false positives.
• Namecheap will not give you the domain holder's contact details without the customer's permission, except in limited cases such as an official US court order or subpoena.
• Namecheap does not promise to tell you what it found or did about your report.
• The [email protected] address is only for law enforcement and government agencies; Namecheap says reports from anyone else sent there will not be processed.

What happens after you report

• Namecheap says every complaint is investigated and action is taken when necessary under its policies, but it may not reply with the results.
• To see whether anything happened, look up the domain's status on Namecheap's Whois lookup. clientHold or serverHold means it has been suspended.
• Keep later messages about the same domain in one thread rather than opening new complaints, as Namecheap asks.
• Namecheap says its general abuse complaint processing time is 72 hours, varying by case, and that this is not the time it takes to resolve the issue.

Write the report

Paste the link, phone number or email address and we'll write the message for Namecheap. You send it yourself.

Is the site also hosted on Namecheap Hosting?

This page is about the domain name. If the scam pages sit on Namecheap Hosting's servers (an IP lookup shows it), the hosting route is the one that can take the content down. Report to both when the same company does both jobs.

Not sure who hosts the site?

Scan it: we'll identify the host and registrar and give you the routes that apply.