Beyond compliance: how Namecheap tackles online harms
Every registrar has to deal with DNS abuse. Phishing, malware, botnets, pharming, and harmful spam: these are ICANN-defined categories, and acting on them isn’t optional. It’s the minimum.
But the Internet doesn’t stop at the minimum, and Namecheap doesn’t either.
The harms that cause the most damage to real people (child sexual abuse material, non-consensual intimate imagery, illegal drug and weapons sales, human trafficking) sit outside ICANN’s formal DNS Abuse definition.
Registrars aren’t required to act on them. But some things don’t need a policy for us to act on them.
This piece is about that decision: what we act on, why it matters, and how we do it.
Two terms, one important difference
DNS Abuse has a specific meaning in the registrar world. ICANN defines it as five categories: phishing, malware, botnets, pharming, and spam when used to send the other four categories. Registrars are contractually required to act on these.
Online harms cover something broader. Content and activity that causes serious damage to people, but falls outside what ICANN mandates. No contractual obligation. No compliance checkbox.
What a registrar does in that space is usually pretty telling.
Harms that don’t wait for a policy
Child sexual abuse and non-consensual intimate imagery
Namecheap has zero tolerance for CSAM (child sexual abuse material) and NCII (non-consensual intimate imagery) on any domain registered through us.
We’re one of the first registrars to partner with the Internet Watch Foundation, an organization dedicated to removing child sexual abuse content from the Internet. Through that partnership, we receive active reports and TLD hopping lists: intelligence on how bad actors move between domains to stay ahead of takedowns. That feeds directly into how we identify and action abuse.
On NCII, the TAKE IT DOWN Act addresses the non-consensual sharing of intimate imagery, including AI-generated content. It was the kind of legislation worth getting behind before it became a legal requirement. We also work with third parties focused specifically on supporting victims of image-based abuse, separate from our CSAM work. We’re also coordinating with groups that combat NCII and exploring opportunities to proactively identify and remove verified NCII from our platform.
If you need to report CSAM, both Namecheap and Spaceship have a dedicated channel. Just send an email to abuse@namecheap.com.
Serious crime
When we receive a credible report of serious criminal activity, including illegal drug or weapons sales and content connected to human trafficking, we investigate promptly. If needed, we also work with law enforcement to have dangerous content removed as fast as possible.
We have good working relationships with trusted law enforcement agencies and governments, so we can report serious criminal activity to the proper authorities. They can then let us know if they discover serious online harms on our platform.
Although we identified several types of serious crimes in this article, it is not an exhaustive list. Namecheap has zero tolerance for bad actors using our services to commit criminal activities, and our team is trained to recognize and prioritize reports of dangerous criminal activity.
In addition to receiving reports of serious crime and DNS abuse, our team uses various methods and systems to identify criminal activity before it can be reported to us. These efforts come with significant costs, but we believe in doing the right thing to protect our customers and the Internet.
Fraud at the point of registration
Not all harm is visible on a webpage. Some of it starts before a domain is even live.
Our payment systems flag and block purchases made with stolen credit cards. There is no legitimate reason to use a stolen credit card to purchase a domain name or related services. It’s always a signal of intent, and we act immediately to prevent future harms.
Stronger together: working with the wider industry
No registrar works in isolation. Industry bodies are often where shared standards get built and information moves when it matters.
Namecheap actively participates in the Internet Infrastructure Coalition (i2C), the Internet Infrastructure Forum, the Internet & Jurisdiction Policy Network, Nominet, ICANN’s Security and Stability Advisory Committee, and the Advisory Committee for the NetBeacon Institute. Namecheap is also a leader in ICANN’s Registrar Stakeholder Group, supporting and leading various efforts to reduce and mitigate online harms.
The industry also operates through a number of trust groups set up specifically to escalate harm cases and share intelligence between companies dealing with the same problems. Namecheap also coordinates with members of the financial, security, retail, and cryptocurrency exchange industries.
Why any of this matters
A domain registrar is infrastructure. And infrastructure that enables serious harm, even passively, is part of the problem. That’s not a comfortable position to sit in, and it’s not one we’re willing to accept.
The harms covered in this piece don’t stay online. They have real consequences for real people, and the registrar whose infrastructure hosts them is part of that chain whether they act on it or not.
The RrSG (Registrar Stakeholder Group at ICANN) recently published two documents further explaining why registrars work to reduce online harms: Why Registrars Want to Mitigate DNS Abuse and Financial Impacts on Registrars of DNS Abuse. It’s a step toward the industry formalizing what responsible practice looks like beyond the required minimum.
That’s how principles become practice.
More in this series
This piece is part of a series on Safety, Trust, and Policy. The first looked at whether email verification timing actually reduces DNS abuse.
Coming up: what actually works against DNS abuse, the lifecycle of an abusive domain, and where registrars can most meaningfully intervene.
