Home / Blogs

Namecheap, EFF and the Dangerous Internet Wild West

This past week I had two items pop up on my alerts. The first was about Facebook suing domain registrar Namecheap for allowing domains that impersonate the social media company and can be used for scams. The second was a plea by the Electronic Frontier Foundation to join in its crusade to stop the sale of the .ORG domain. It took me a moment to realize these are linked.

Namecheap is known for its refusal, short of a court order, to crack down on bad actors who register domains used to spread malware, steal personal information, send spam and conduct cyberattacks. According to cyber monitoring firm SpamHaus, 25 percent of so-called botnet domain names were registered through Namecheap—making it the third straight year it held the title as the company with the most abused domains.

The Facebook lawsuit shows why. In its lawsuit, Facebook cited 45 Namecheap domains, such as ‘instagrambusinesshelp.com’, that appear to be associated with the social media company but, Facebook says, can be used by bad actors to “trick people into believing they are legitimate and are often used for phishing, fraud and scams.”

It’s not the first time Namecheap has been called out for not making Internet safety a priority. Online pet adoption scams are on the rise. Criminals create websites that offer to ship dogs after a would-be owner pays fees, but it’s a scam and the dog never is delivered. In an article entitled, “Namecheap, you are hurting the Internet!,” the group Petscams.com, which manages a database of fraudulent websites that pose as pet adoption centers, points out that Namecheap has nearly four times as many scam websites as any other registrar.

This track record is why I would never use Namecheap for domains. After all, life is about the company you keep. Which gets us to EFF and .ORG. The group wants to stop the sale of .ORG to a private company. But like Namecheap, EFF’s track record on Internet safety is dubious. This is the organization that is trying to overturn a federal law aimed to stop sex traffickers from using websites such as Backpage to advertise and conduct business.

But EFF and Namecheap have a lot more in common than I realized. In the last decade, Namecheap has contributed $390,000 to EFF to fight against restrictions that could prevent bad actors from using the Internet to engage in sex trafficking, conduct scams, and spread malware that can lead to identity theft, financial loss and ransomware. It’s hard not to connect the dots. Namecheap pays EFF to work to block Internet safety legislation and initiatives; Namecheap makes money by being the go-to domain company for bad actors who create domain names that can be used for scams and malware and other potential illicit activity.

As someone who owned and operated domain names, I’m stunned that this business model is acceptable in 2020. This is the Internet equivalent of a medical testing lab building a business model around the spread of the coronavirus. Namecheap stands out as a domain company that refuses to cooperate when companies such as Facebook come to them with evidence that its domain customers are engaging in shady behavior.

And EFF has 390,000 reasons to help them.

But at what cost? According to Internet security company Emsisoft, the 2019 impact of ransomware went way beyond the estimated $7.5 billion price tag. Because of ransomware, emergency patients had to be redirected to other hospitals; medical records were inaccessible or permanently lost; surgical procedures were canceled; tests were postponed; and, 911 services were interrupted. This is the real impact of not stopping online criminals and other bad actors.

Keeping the Internet free and safe are not mutually exclusive. Just as shouting “fire” in a crowded theater isn’t protected speech, criminals who use the Internet to scam people, coerce them into ransomware payments, engage in sex trafficking, and spread malware shouldn’t be protected. You would think that Namecheap and EFF would understand the difference. And if they do understand the difference and still fight efforts to keep the Internet safe, that’s disturbing.

By David McConnell, Business Owner and Consultant

David is based in North America and South America and has worked with Internet companies on policy-related issues.

Visit Page

Filed Under


Who decides whether some accused domain name Phil Howard  –  Mar 13, 2020 1:38 AM

Who decides whether some accused domain name is really a bad actor, or not?  why not also have other services the bad actors get severed from them, such as their electricity and internet service?

i’m not in favor of bad actors.  but i am very much opposed to trivial ways to let big business shut down innovative competition.  there are better ways to shut down the bad actors.

"EFF works to block internet safety regulation" Kevin Ohashi  –  Mar 14, 2020 11:40 AM

“EFF works to block internet safety regulation” - HA.

Just like the ACLU is working to hurt us?

I find it strange to see someone signup to post this in the midst of the .ORG battle who has no history, no links, no information about themselves. What are your connections to this? This just looks like a poorly argued hit piece.

EFF and what they fight for Peter Cobertos  –  Apr 8, 2020 3:45 AM

Nah, EFF fights, by-and-large, for rights that are aligned with individual and consumer rights. They’re doing good work.

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet




Sponsored byVerisign

New TLDs

Sponsored byRadix

Threat Intelligence

Sponsored byWhoisXML API

Brand Protection

Sponsored byCSC

Domain Names

Sponsored byVerisign


Sponsored byDNIB.com

IPv4 Markets

Sponsored byIPv4.Global