# Report a phishing domain registered at Namecheap Someone registered a domain that imitates yours, and it's registered through Namecheap. Namecheap takes abuse reports by email, and it publishes exactly what evidence it needs for each kind of abuse. A complete report the first time is the fastest route. If customers have already received fake emails, start with [Someone is pretending to be my company](/guides/someone-is-pretending-to-be-my-company). Warning customers and stopping payments come before the takedown. ## Step 1: confirm Namecheap is the registrar Look the domain up on [ICANN Lookup](https://lookup.icann.org). The RDAP result names the registrar and its abuse contact. For Namecheap it shows: ``` Registrar: NameCheap, Inc. Abuse email: abuse@namecheap.com Abuse phone: +1.6613102107 ``` Then check where the domain points, because the registrar and the host are often different companies: ``` dig +short A examp1e.com dig +short MX examp1e.com ``` Look up the owner of the IP addresses. If the website or mail is hosted by Namecheap too, its hosting abuse address is `abuse@namecheaphosting.com`. If it's hosted elsewhere, report to that host as well, and if it sits behind Cloudflare, see [Report a phishing site behind Cloudflare](/guides/report-phishing-domain-cloudflare). ## Step 2: collect what Namecheap asks for For **phishing**, Namecheap's abuse page asks for: - the abusive domain name(s); - the abusive URL(s): the full path to the fake login page, not only the domain; - the target of the attack, meaning your legitimate website; - the country your IP address belongs to, because the content may be geo-blocked and they will try a matching proxy; - the device and browser you used, because the content may differ between phone and PC. For **email fraud**, for example fake invoices sent from the lookalike, it asks for the domain, screenshots, and the full headers and body of the email. Two rules from Namecheap's page that are easy to miss: 1. **Don't attach the original malicious email** or any malware. Send the headers as plain text, screenshots, and URLs written in defanged form (`hxxps://examp1e[.]com/login`). 2. **Attachments** must be csv, doc, docx, eml, jpeg, jpg, pdf, png, txt, xls or xlsx. ## Step 3: send the report Email `abuse@namecheap.com`. Keep it short and factual: ``` Subject: Phishing: examp1e.com impersonating example.com examp1e.com (registered 2026-10-21 via Namecheap) is being used to impersonate our company, Example Ltd (example.com). Phishing URL: hxxps://examp1e[.]com/microsoft-login Target: https://example.com Viewed from: United Kingdom, Chrome on Windows 11 Since 2026-10-24 it has sent emails asking our customers to pay invoices to a new bank account. Full headers of one message are attached as headers.txt, with screenshots of the email and the page. We are the owner of example.com. Contact: Jane Smith, IT manager, +44 20 0000 0000. ``` Say what the domain is **used for**. "It sends invoice fraud emails as our company" gives the abuse team something to act on; "it looks like our domain" doesn't. ## What to expect Namecheap says its general processing time for abuse complaints is 72 hours, and that this may vary by case. Processing isn't the same as resolution, and Namecheap may not tell you the outcome of its investigation. One limit worth knowing: when Namecheap is only the registrar and the content is on someone else's servers, it says it may not be able to verify some kinds of abuse, and won't take restrictive action in those cases. Its page names copyright, spam, fraud and malware. That's why a report to the host in parallel matters, and why a live phishing page with a full URL is stronger evidence than an email alone. Keep all follow-ups in one email thread, with the engagement ID Namecheap gives you in the subject line. ## If nothing happens 1. **Report to the blocklists** while you wait: [Google Safe Browsing](https://safebrowsing.google.com/safebrowsing/report_phish/) and [Microsoft](https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site). 2. **Complain to ICANN.** Since 5 April 2024, ICANN-accredited registrars must promptly take reasonable action once they have actionable evidence of DNS abuse, which includes phishing. If a registrar doesn't investigate or respond, file an "Abuse/DNS Abuse (Registrar)" complaint with ICANN Contractual Compliance. ICANN has no compliance authority over country-code domains (.uk, .de and so on). 3. **Contact the registry.** The registry that runs a generic top-level domain has a duty too: on actionable evidence of DNS abuse it must at least refer the domain to the registrar or act directly. ICANN Lookup shows which registry that is. 4. **UDRP**, if the domain keeps being used and you hold a trademark. It can transfer the domain to you, but costs fees and takes weeks. See [How to report a lookalike domain](/guides/report-lookalike-domain-takedown). Registered somewhere else? See the guides for [GoDaddy](/guides/report-phishing-domain-godaddy) and [Cloudflare](/guides/report-phishing-domain-cloudflare). ## Check your domain The [free scan](/#scan) lists registered lookalikes of your domain, how recently they were registered and which can already send email. The [lookalike domain checker](/tools/lookalike-domain-checker) runs that check on its own. ## Sources - [Namecheap: How and where can I file abuse complaints?](https://www.namecheap.com/support/knowledgebase/article.aspx/9196/5/how-and-where-can-i-file-abuse-complaints/) - [Verisign RDAP: namecheap.com (registrar abuse contact)](https://rdap.verisign.com/com/v1/domain/namecheap.com) - [ICANN Lookup (RDAP)](https://lookup.icann.org) - [ICANN: Advisory on DNS abuse obligations in the RAA and Registry Agreement](https://www.icann.org/en/contracted-parties/advisories/documents/advisory-compliance-with-dns-abuse-obligations-in-the-registrar-accreditation-agreement-and-the-registry-agreement-05-02-2024-en) - [ICANN Contractual Compliance: submit a complaint](https://www.icann.org/compliance/complaint) - [ICANN: Uniform Domain-Name Dispute-Resolution Policy](https://www.icann.org/resources/pages/help/dndr/udrp-en) - [Google Safe Browsing: report phishing](https://safebrowsing.google.com/safebrowsing/report_phish/) - [Microsoft: report an unsafe site](https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site) --- Source: https://nameward.app/guides/report-phishing-domain-namecheap (updated 2026-10-30)