Hacker News new | ask | show | jobs
by someotherperson 1541 days ago
It's called domain name front running. GoDaddy in particular has been accused of this in the past here on HN and have responded to it[0].

Use a trustworthy registrar when you can, avoid GoDaddy or Namecheap.

[0] https://news.ycombinator.com/item?id=24506303

3 comments

Hopefully some additional links too, to show how it evolved from Domain Name Front Running[0]. Moved into Domain tasting (which things like Domain Kitting is related to) [1].

There are posts all the way back to 2011[2] and probably further showing GoDaddy doing this for some time, and even I spotted it when using Network Solutions back in the day [3].

ICANN introduced charges (from the Wiki article) to try and reduce the Domain Tasting element, so I a guessing it is better now), but I (my personal opinion) think that it is still out there, just not as obvious as it once was!

[0] https://en.wikipedia.org/wiki/Domain_name_front_running

[1] https://en.wikipedia.org/wiki/Domain_tasting

[2] https://news.ycombinator.com/item?id=2326790

[3] https://news.ycombinator.com/item?id=22005265

Is there any anecdotal evidence that Namecheap does this?
I'd add my anecdotal evidence that namecheap doesn't do this. I've searched quite a few domains on namecheap and then bought them months later without issue. I have had this issue (although of course it's impossible to know for sure who's registered the domain) with GoDaddy and Gandi.
Second this: recently, a startup of mine let summer domains lapse and bought them back for the same price, when NC could've easily squatted them.
What is wrong with Namecheap?
It's a criminal outfit masquerading as a domain registrar. They go out of their way to protect blackhats using their services, refusing to adhere to their ICANN requirements of blocking users or domains registered through Namecheap that carry out major scale phishing and fraud. So much so that, with blackhats, it's the domain registrar of choice. Stolen credit card? No problem. SMS scams? Sounds good!

Do a WHOIS the next time you come across a phishing website or receive an SMS with an odd link. And then disappoint yourself with the complete lack of care when trying to report it to Namecheap's support.

Their CTO or whoever considers this form of enabling crime to be 'free speech' or suggesting registrars shouldn't 'police' or something equally as stupid when it was raised on HN a few times.

As a non criminal, this is a major selling point for me. I for one do not want to lose my entire business because I offended someone or failed to moderate a comment or whatever. And it’s smart business for them too - stay out of the censorship game as long as you can, because you can never win.
Yes of course until the CEO popped up and unilaterally banned all of Russia[0]. Or when they banned a crypto related domain on a single tweet[1] then unbanned it when people said WTF [2].

Blocking actual exploitative malware is a legal obligation, not "censorship." If they had a TOS that says "do whatever you want" then sure, but in this case they're just violating their TOS too.

[0] https://news.ycombinator.com/item?id=30504812

[1] https://twitter.com/Namecheap/status/1489485337885921284

[2] https://twitter.com/Namecheap/status/1489504958596714499

You realize a lot of their staff is pretty much next door to that conflict geographically right?
> ... It's a criminal outfit ...

Refusing to police does not mean "they go out of their way to protect blackhats", it means they sell domains and know their place.

Refusing to adhere to your TOS, ICANN guidelines and legal obligations by turning a blind eye to international crime rings isn't knowing your place, it's exploitation and has horrible ethics regardless of how it can be perceived.

Knowingly taking money from criminals, likely stolen, is almost certainly a criminal offence.

I'm sure if you were to provide them with evidence of your allegations they would take actions appropriate to their obligations. What you want them to do is that work _for_ you, which they are not obliged to do, as far as I know.
I (and many others) have provided full evidence and it's not actioned. Or I would give 20 domains with 20 subdomains -- all from the same circle, same time of registry, same phishing concept -- and they would only action one and stop responding to emails after.

Don't assume what I want them to do. They have been spoonfed the information and their Eastern European support staff/legal department doesn't care. Then their C-levels come on here and claim nonsense about free speech when quizzed about it.

Just because they don't immediately cancel people you have issue with doesn't make them a criminal org. You should check out about libel because this is getting close.
I'd like the opportunity to actually have this heard in a courtroom. Although the FBI would probably do most of the talking.
Sounds like added value to me