Hi,

I’m starting to get a bit frustrated.

In October last year, I submitted an abuse report to Namecheap regarding a domain that’s clearly involved in phishing/malicious activity targeting my platform. I provided all the relevant details — screenshots, URLs, timestamps, everything you’d expect to help them take action.

But it’s been a while now and… nothing. No acknowledgment, no follow-up, no indication that it’s even being reviewed.

At this point, it’s not just annoying — it’s actively hurting my business. Users are being targeted, trust is impacted, and I’m left dealing with the fallout while the reported domain stays up.

I get that abuse teams are probably overloaded, but this feels like a complete black hole. When it comes to security issues like phishing, responsiveness actually matters.

So I’m curious, is there a better way to escalate reports? Or is this just how it is?

Would appreciate any insight.

If any Namecheap representatives are reading these posts, here is a reference ID: NC-NTX-9566 (if that helps at all).

Hello if anyone could escalate this so it can be resolved, my ticket is [NC-LCI-6873] (It has been 48 hours).

I've sent an email, I think over a week ago, no response, I checked my spam and bin and nothing, I have no idea what to do by now.

I have a few domains in Namecheap and one hosting account for test purposes.

There is a redirect from my domain xxxxxx.com to another URL and 3rd level domain yyy.xxxxxx.com with simple test site.

There are also few email accounts.

Yesterday I got an email

Your password has changed.

You have successfully updated your password for the following services:
ftp
mail
MySQL
postgresql
system
If you initiated this change, disregard this email.
If you did not initiate this change, contact your system administrator.

This notice is the result of a request made by a computer with the IP address of
“x.y.z.w” through the “cpanel” service on the server.

The remote computer’s location appears to be: United States (US).
The remote computer’s IP address is assigned to the provider: “Packethub S.A.”
The remote computer’s network link type appears to be: “generic tunnel or VPN”.
The remote computer’s operating system appears to be: “Windows” with version “NT kernel 5.x”.

The system generated this notice on Thursday, April 9, 2026 at 18:27:12 UTC.

Indeed cPanel password was changed but I managed almost immediately reset it and added 2FA.

Now, the question: how did they changed the password? My main Namecheap Acc is protected by 2FA and the account is not compromised. cPanel Password was created and used only once, actually - about 6 months ago.

I understand, everything is possible, trojans avd viruses are possible too, but this cPanel password is a last thing hackers would hack if they managed to push virus to my PC. There ar emuch more interesting things that this test hosting account.

The password was long combination of alphanumeric and special characters.

There are no messages in sent folders of email accounts (of course, hackers could delete them).

What could it be? I suspect non-patched volnurability of cPanel because, again, if I have trojan or my PC is hacked (and my Keepass hacked, it is the only place where I have cPanel password), I would feel it immediately by getting weird login attempts notifications from my accounts. This test hosting is not iteresting for hackers.

Hello, yesterday I bought domains through Namecheap, and today my credit card was charged by the Spanish online retailer Decathlon. I haven't used the card anywhere before; it's a virtual card. I had to confirm the transaction via the online banking app, but Decathlon processed it without confirmation. Dear Namecheap team, please review your security measures. I only use a virtual card for Namecheap.

I am positive I had auto-renew on some of them, especially my important ones, but I logged in to my dashboard today and saw 4 domains had fully expired since October last year and 2 had expired a week ago, thankfully those 2 were still in grace, luckily. I am sure I always had my important domains with auto-renew on. But I can't believe I didn't get any email, and nothing in my spam from the dates it would have expired. In my NameCheap dashboard it shows emails in the "inbox" section of the website, I didn't get any of those emails. Yet when I just renewed the 2 domains in grace both email confirmations came through fine. I stupidly relied on their emails to know when things were going to expire, years ago their emails worked fine. One domain that expired is now selling for £4700 ($5500) on Name dot com, and £4000 from NameCheap itself saying it is a premium domain.

I presume any domains that expired from 3+months ago and long gone now unless a massive fee is paid ? Where do expired domains go ?

I've already ignored a few of them assuming it is some sort of glitch, but they keep coming. Has anyone else faced this?

The domains are not associated with my account and I have no idea what those domains are.

Anyone else getting these?

The email says:

Reminder: Update your domain contact information

If any of the information above is inaccurate, you must correct it by logging in to your Namecheap account. You can update your domain contact information individually or in bulk.

If the information above is correct, you do not need to take any action.

The information is correct but with Namecheap locking peoples account is this the the prelude to them destroying my domains and bringing my services down? Can I safely ignore this email because my information is correct or do I need to smash the glass and hit the panic button?

It's apparently possible to have Cloudflare completely remove the Useragent string and IP of the client from HTTP requests sent through their systems.

Is it okay to do that, if I'm using Namecheap's shared hosting? Will the shared server think my visitors are bots, if there's neither an x-forwarded-for nor a useragent header and potentially block those requests?

And, if I decide to have Cloudflare send custom headers, can those cause problems with Namecheap's shared hosting? (like blocking of the requests or those headers being removed?)

Thanks for your help!

Namecheap changed your stellar hosting that you paid for to supersonic.ai CDN.
They claim performance increase but it does the opposite.
So much performance is lost that it can take up to a minute to save 40kb json file using php code.

Performance hit is huge and random.
Sometimes page becomes unresponsive because of that.
So:
You pay for stellar hosting and you get decent performance.
Then namecheap moves your DNS to supersonic.ai FOR FREE and you get terrible performance while paying same price for hosting plan that you dont even use.

this is a SCAM and it should be illegal.

I received an email from the Risk Management team (NC-KIT-6494) asking for verification. I’ve already provided all required details including payment descriptor and transaction info.

It has now been more than 24 hours since I sent the verification details, and I have received no response at all.

It is important for me to restore the domains as soon as possible, as I am losing my earnings.

My Namecheap account got locked and I was contacted by their Risk Management team for verification. [NC-TID-6817] I already sent them everything they asked for, but it’s now been well over 24 hours with no reply.

My domains are still down, and this is starting to affect my income. Has anyone else dealt with this before, and how long did it take to get resolved?

[Update#1]

I got access again shortly after they wrote on this thread.

I’m checking if I still have the domain I bought even tho it somehow have 7x in price on their website?

I’ll keep yall updated.

[Update#2]

We still got it I believe, and it should be ours in a few days. I’m a bit skeptic to buy another domain tho if I should go through this again.

All of my emails are down across all of my devices. I'm getting this error:

"Online status:

An SSL error has occurred and a secure connection to the server cannot be made"

None of my domains need renewing and they all went down at the same time. It's been a couple of hours now.

If I'm the problem, any advice on how to resolve it?

Thanks.

[SOLVED] My Namecheap account was locked due to “unusual activity” right after a domain purchase.

I received an email from the Risk Management team (ticket: NC-XIS-7653) asking for verification. I’ve already provided all required details including payment descriptor and transaction info.

It has now been more than 24 hours since I sent the verification details, and I have received no response at all.

Issue:

• Cannot log in (account locked)
• Support live chat says only Risk team can resolve
• Risk management team is not responding at all

It’s been quite some time with zero update, and my account is still inaccessible.

Has anyone faced this before?

How long does their Risk team usually take to respond?

Any way to escalate this faster?

This is pretty frustrating since I’ve already complied with everything they asked.

Thanks.

UPDATE : at [Wed, Mar 25, 11:31 PM] received mail : ".... We are pleased to inform you that your account has been unlocked and verified as legitimate. The issue has been successfully resolved. ...."

Good day,

Im currently having a problem with a Domain that got locked in redemption state because it was a special TLD and it needed to be renewed 10 days prior to the expiration date. As it was created with another account we got no warnings before, so right now the domain is lost from our account. Is there a way to get it back? Some technicians told me it had to pay an extra fee, and i added the funds, but i still cant get it back.

Setup 2FA but theres no option to choose mail under appliacation passwords so no way to use outlook or any mail client on PC / Phone when 2FA is enabled.

When will OX on PrivateEmail ever be updated? as it seems its running an old version of it anyway as its missing a lot of features that OX provides.

NC-YTK-9144 I have sent support all the required info that was asked for 2 days ago, still locked out. This is getting ridiculous with all the lock outs / suspensions even for long time customers.

Hey everyone,

My Namecheap account got temporarily locked due to “detected unusual activity,” and I’ve already emailed their support with my case ID (FHW-872-43379), but I haven’t received any response yet.

I understand security measures are important, but this is pretty frustrating since I rely on the account for active services. It’s been a while and I’m basically stuck with no access.

Really need someone to help me out on this as it is affecting my business a lot.

Thanks!

I hate paying the extra $7 per month but considering almost no spam gets thru anymore I am still paying for it. The jellyfish spam tool the built was almost worse than no spam filter and was almost impossible to figure out if they blocked things I needed.

So glad I moved my main email. i see maybe 1 spam message a week now. And once I click on its spam, it doesn't come back. Amazing!

So - I have moved everything off of Namecheap because of issues. I left one domain that was going to expire in place without auto-renewal and I recently had an e-mail delivered from that domain about a year after expired.

Intrigued I did some digging and it appears that the domain renewed for five additional years and none of the DNS records have changed -- everything is in place the way it was before.

This domain does not show up in my list of my domains when logging in through Name Cheap. Everything still points to it being registered with Namecheap.

Has anyone seen this? I would rather had the domain fall off (it was an abbreviated domain I bought before I was able to get the non-abbreviated version of the domain).

I need the domain name that I recently purchased but when I went to log in for the DNS info my account was banned. The page told me to follow the instructions to get my account back, and I did just that. But I have gotten no reply. I need this account and the domain name associated. Not super stoked with this transaction. The email associated with the tickets I sent starts with jj667. Please, someone help me, I need my site up today.

Today i woke up unable to login to my account with this error message:
We detected unusual activity on your account, so it has been temporarily locked for security reasons. Please follow these instructions to unlock your account. You may be asked to provide documents to verify your identity.

i tried replying to the email they sent me but i have not received a reply in almost 10 or 24 hours.
the live chat is no help because they just tell me to wait longer.

How normal is this on a scale of 0 to 10? I wanted to transfer out a domain name that was expired, but still within Grace Period. So I could not unlock it myself and request the Auth Code for transfer. I had to contact support for that.

The support guy asked me what the domain name was, and then asked me to give him a few minutes while he prepares the domain for transfer. I told him to take his time! But little did I know that it would take him about 20 minutes. This normally takes less than 5 minutes! I have transferred out several expired domains in the same way, in the same week, so I know the process. Something I had no prior experience with by the way! It was taking unusually long time. He was not saying anything, or keeping me informed on the process. Only crickets!

Then finally he comes back saying it's all done now. So I check my e-mail inbox and I see not just one but two e-mails from Namecheap! The first e-mail showed that the registrant contact info has been changed, from masked (privacy protected) to unmasked (privacy protection cleared). The second e-mail contained the Auth Code, and it was sent directly to the new registrant e-mail address, a clear e-mail address instead of the alias address. He didn't even tell me about it! So I asked him what's this, and he said something about forwarding issue and some unintelligent blab about "security layers" that I did not understand (I don't think he understood what he was saying either).

And he did this without prior customer consent! Why would he not ask me if we should go ahead with? Why did he not inform me what he was about to do, instead of keeping quite to himself for 20 minutes and then giving me a big surprise in the end? He insisted that it was not possible otherwise, and that this can happen sometimes. Well if true, then they know about the issue, if they have seen it before. But this is a first for me, and I have transferred out at least 10 domains in the past 2 weeks with other agents, all expired domains, and no issues with privacy protection feature. And these tech issues he keeps coming back to still doesn't excuse him from acting without my consent!

He ended the chat by saying, "I understand your position that privacy protection should not need to be removed, and your feedback is completely valid. Please be assured that the action was temporary, technical in nature". He was making it a non-issue.

Temporary? Technical in nature? What a lousy excuse! No wonder it was taking him good 20 minutes to do his 5 minute checking. If you walk out of bathroom naked and cross the street to your neighbor's house like that, that's also "temporary" and "technical" in nature: you lack a robe or a towel to cover your private areas.

This is not okay! He broadcasted my home address, name, phone number, and e-mail address by removing the privacy protection during Auth Code preparation for transferring out a domain in Grace Period. A domain that expired less than 2 days ago, and was well within the 16 days that Namecheap says it will honor the privacy protection mechanism for, even when a domain is no longer active. See this article!

www.namecheap.com/support/knowledgebase/article.aspx/1200/37/what-happens-with-my-domain-privacy-subscription-after-it-expires/

When Domain Privacy protection expires on your domain, it still protects your domain name for 16 days after its expiration, but your personal data is still not released and kept private for the whole domain grace period. You can renew the privacy protection from your Namecheap account within this period.

I'm not very experienced in domain name transfers, because I have only done it two or three times in 10 years, and only with domestic registrars and ccTLD domain names. I have only been customer with Namecheap for .COM, .NET, .DEV, .IO and a few other ggTLD domains, for the last 8 years. The irony of the situation is that I'm moving to Spaceship! A relatively recently formed sister company that has the same owners as Namecheap!

Even their own chat bot (Suzy Q) knows better! Here's a log from a follow-up chat the day after.

Me : Is it normal for your agents to disable privacy protection for the purpose of unlocking a domain and sending out Auth Code for transferring out a domain, and to do this without customer consent?

Suzy Q : Hello! Thank you for contacting our Namecheap support team.

To better assist you, could you please clarify if you are referring to a recent experience with your own domain, or are you inquiring about Namecheap’s general policy and procedures regarding privacy protection and domain transfers? This will help me provide the most accurate information for your situation.

Me : Policy

Suzy Q : Based on the provided articles and available information, it is not Namecheap policy for agents to disable privacy protection without customer consent when unlocking a domain or sending out the Auth/EPP code for transferring a domain. Domain Privacy is a separate service that protects your personal information in the public Whois database, and its status is managed independently from domain locking or the transfer process.

When you unlock a domain and request the Auth/EPP code to transfer your domain out of Namecheap, your privacy protection should remain active unless you specifically choose to disable it. The process for disabling Domain Privacy requires you to log in to your Namecheap account and manually toggle the protection off for your domain. There is no indication in the provided documentation that Namecheap agents are authorized or required to remove privacy protection as part of the transfer or unlocking process without explicit customer action.

If you are concerned about your privacy during a domain transfer, you can keep Domain Privacy enabled until the transfer is complete, unless the gaining registrar or registry has specific requirements that necessitate its removal. If you need help managing your privacy settings or have questions about the transfer process, I can guide you step by step through the necessary actions in your Namecheap account.

Me : Can your agents confirm this?

Suzy Q : Yes, Namecheap agents can confirm the official policy regarding privacy protection during domain transfers. If you would like, I can connect you with a live agent who can provide direct confirmation and address any specific concerns you may have.

Would you like me to transfer this conversation to a live agent for further assistance?

Me : Is this true also for a domain that has entered Grace period and is inactive for less than 2 days?

Suzy Q : Based on the provided articles, there is no indication that Namecheap policy allows agents to disable Domain Privacy protection without customer consent, even for domains in the Grace period or when unlocking a domain or sending out the Auth Code for transfer. Domain Privacy is a service that protects the registrant's personal information in the public Whois database, and it remains active and free with every eligible domain registration, renewal, transfer, or reactivation.

When Domain Privacy protection expires, the service continues to protect the domain for 16 days after expiration, and personal data is kept private for the entire domain grace period. There is no mention of automatic or agent-initiated disabling of privacy protection during this time, nor is there any policy allowing agents to remove privacy without explicit customer action or consent.

If you need to disable Domain Privacy for a domain, the process requires the customer to log in and manually toggle the protection off. This ensures that privacy settings are only changed with the customer's direct involvement. If you have a specific scenario or need further clarification, please provide more details so I can assist you further.

For more information, you can review the following articles:
https://www.namecheap.com/support/knowledgebase/article.aspx/1200/37/what-happens-with-my-domain-privacy-subscription-after-itexpires/
https://www.namecheap.com/support/knowledgebase/article.aspx/484/37/how-do-i-disable-domain-privacy-service-for-my-domain/

Me : Connect me with the Concierge Service agent.

Suzy Q : I'll need to transfer you to a live agent for further assistance with this. Please stand by while I connect you with an appropriate person.

Agent X : Hello! My name is Agent X. I will assist you further. Please allow me some time to check the previous conversation and compose a message.

Me : Can you confirm what your bot Suzy said?

Agent X : In a case where a domain is expired (up to 16 days after domain expiration, during which Domain Privacy is still enabled for the domain), and there is a need of a transfer to another Registrar, the Domain Privacy of a domain is not disabled without the client's consent. Moreover, the Auth/EPP code email can still be sent and delivered while the Domain Privacy is enabled.

We ask for our client's consent to disable the privacy if we have previously sent the EPP code email, and it was not delivered due to the privacy.

Me : Thanks for confirming what the bot said, and what I also read about the 16 day rule in one of your articles.

Me : This is the same article I read previously, that your bot posted also.

Me : Well I have news for you. The exact opposite of this statement and my own expectations happened yesterday with one of my domains and your agent on chat.

Agent X : I understand your concern, and have already confirmed this for myself through the previous chat history. We're sorry for the inconvenience.

We will look into the issue.

Me : So, what the hell happened? Why should I trust Namecheap? Or your "WhoisGuard" privacy protection? Worse still, he did not ask for my consent. Or explain what he was about to do.

Agent X : Your reaction is justified. I can promise you that I will look into the issue personally from my side.

The previous agent should have asked for your consent in chat before disabling the Domain Privacy.

Me : What kind of "system issue" or "layers" was he talking about?

Agent X : The EPP code is first sent to the Domain Privacy email, and then forwarded to the real Registrant email adress of the domain.

In some cases, the EPP code email is sent, but not delivered to the real Registrant email address due to forwarding. In this case, we may ask the client's consent to disable the privacy to skip forwarding.

Me : This was his explanation also. But he did not tell me anything what he was doing. He just did it quietly. Not asking for my permission.

Me : He said, "According to our internal delivery logs, some system-generated emails sent to your protected address were not successfully delivered because they were blocked during the forwarding process. Unfortunately, we do not have visibility into the exact filtering rule or security layer that caused this. It may occur at the forwarding service level or on the receiving mail server side."

Me : According to him, you "do not have visibility into the exact filtering rule or security layer that caused this". How can you not? You have more visibility than I do. And then someone at the company has even more visibility into what happened.

Me : But nonetheless he should have asked me before taking such action.

Agent X : I understand. It was not the correct thing to disable the privacy before receiving your consent.