Report a phishing domain registered at Namecheap

Someone registered a domain that imitates yours, and it's registered through Namecheap. Namecheap takes abuse reports by email, and it publishes exactly what evidence it needs for each kind of abuse. A complete report the first time is the fastest route.

If customers have already received fake emails, start with Someone is pretending to be my company. Warning customers and stopping payments come before the takedown.

Step 1: confirm Namecheap is the registrar

Look the domain up on ICANN Lookup. The RDAP result names the registrar and its abuse contact. For Namecheap it shows:

Registrar:      NameCheap, Inc.
Abuse email:    [email protected]
Abuse phone:    +1.6613102107

Then check where the domain points, because the registrar and the host are often different companies:

dig +short A examp1e.com
dig +short MX examp1e.com

Look up the owner of the IP addresses. If the website or mail is hosted by Namecheap too, its hosting abuse address is [email protected]. If it's hosted elsewhere, report to that host as well, and if it sits behind Cloudflare, see Report a phishing site behind Cloudflare.

Step 2: collect what Namecheap asks for

For phishing, Namecheap's abuse page asks for:

the abusive domain name(s);
the abusive URL(s): the full path to the fake login page, not only the domain;
the target of the attack, meaning your legitimate website;
the country your IP address belongs to, because the content may be geo-blocked and they will try a matching proxy;
the device and browser you used, because the content may differ between phone and PC.

For email fraud, for example fake invoices sent from the lookalike, it asks for the domain, screenshots, and the full headers and body of the email.

Two rules from Namecheap's page that are easy to miss:

Don't attach the original malicious email or any malware. Send the headers as plain text, screenshots, and URLs written in defanged form (hxxps://examp1e[.]com/login).
Attachments must be csv, doc, docx, eml, jpeg, jpg, pdf, png, txt, xls or xlsx.

Step 3: send the report

Email [email protected]. Keep it short and factual:

Subject: Phishing: examp1e.com impersonating example.com

examp1e.com (registered 2026-10-21 via Namecheap) is being used to
impersonate our company, Example Ltd (example.com).

Phishing URL: hxxps://examp1e[.]com/microsoft-login
Target: https://example.com
Viewed from: United Kingdom, Chrome on Windows 11

Since 2026-10-24 it has sent emails asking our customers to pay
invoices to a new bank account. Full headers of one message are
attached as headers.txt, with screenshots of the email and the page.

We are the owner of example.com. Contact: Jane Smith, IT manager,
+44 20 0000 0000.

Say what the domain is used for. "It sends invoice fraud emails as our company" gives the abuse team something to act on; "it looks like our domain" doesn't.

What to expect

Namecheap says its general processing time for abuse complaints is 72 hours, and that this may vary by case. Processing isn't the same as resolution, and Namecheap may not tell you the outcome of its investigation.

One limit worth knowing: when Namecheap is only the registrar and the content is on someone else's servers, it says it may not be able to verify some kinds of abuse, and won't take restrictive action in those cases. Its page names copyright, spam, fraud and malware. That's why a report to the host in parallel matters, and why a live phishing page with a full URL is stronger evidence than an email alone.

Keep all follow-ups in one email thread, with the engagement ID Namecheap gives you in the subject line.

If nothing happens

Report to the blocklists while you wait: Google Safe Browsing and Microsoft.
Complain to ICANN. Since 5 April 2024, ICANN-accredited registrars must promptly take reasonable action once they have actionable evidence of DNS abuse, which includes phishing. If a registrar doesn't investigate or respond, file an "Abuse/DNS Abuse (Registrar)" complaint with ICANN Contractual Compliance. ICANN has no compliance authority over country-code domains (.uk, .de and so on).
Contact the registry. The registry that runs a generic top-level domain has a duty too: on actionable evidence of DNS abuse it must at least refer the domain to the registrar or act directly. ICANN Lookup shows which registry that is.
UDRP, if the domain keeps being used and you hold a trademark. It can transfer the domain to you, but costs fees and takes weeks. See How to report a lookalike domain.

Registered somewhere else? See the guides for GoDaddy and Cloudflare.

Check your domain

The free scan lists registered lookalikes of your domain, how recently they were registered and which can already send email. The lookalike domain checker runs that check on its own.