Thanks for the question. I can assure you that our legal and abuse team do their very best to address bad actors. In fact, they are one of the hardest working teams in the company. We put a lot of time and due diligence into each case and do not takedown domains without sufficient evidence. We believe that taking domains down without proper cause can be a slippery slope.
I reported a spam domain to namecheap, including a police case file, full emails, and basically everything except a bank statement after my elderly parent was taken for a (several thousand dollar) scam.
Namecheap never resolved it or even responded back beyond the precanned message.
Isn't it the police's job to be seizing property from criminals to prevent crime? Not individual victims. If the police won't demand Namecheap remove it, then sorry? They don't have to. It's not like Namecheap committed the fraud any more than a carmaker robbed a bank because the robber drove away in their car.
Usually if someone is using your property for crime, you have an obligation to stop it.
Don't know if it applies in this particular case though. Clearly the government didn't think so.
This is the very reason that Safe Harbor laws are in place for these industries.
Safe harbor laws only apply when you reasonably don't know or couldn't know about the illegal behavior. Once you become aware of it then safe harbor no longer applies.
If Tesla is aware that a certain car is stolen, and they have the ability to remotely disable it, should they?
And if they’re aware that the car will be imminently used for a terrorist attack, does that change the equation?
And if we trusted Tesla to make that determination, that would be an interesting question. But counterpoint: Do you want Tesla to remotely kill your car because someone decided to tell them that it was stolen? I can think of some "fun" ways for that to blow up...
Contrariwise, should they be permitted that ability, when what it will actually be used for is someone to disable their abused partner's car?
Tesla can do that at government instruction. They have no business doing that if private individual asks for it even if it is world ending nuclear threat terrorist attack.
Same for namecheap. They cannot be the judge of what is spam and not. they should not be asked to gatekeep for the justice system
Your local police department doesn't have any authority over namecheap. In scams, we do open a case file with them so that they can monitor problems, to create a verified paperwork trail and if issues such as stolen identity arise.
Namecheap does have a duty when they are informed with reasonable evidence to not be an accessory to a crime. Prior to being informed, Namecheap is in the clear. Once they're given clear evidence (and in my case it was blatantly obvious because it was a crappy scam) then they do have a duty to act.
It's the difference between Ford selling a car which happens to be used in a bank robbery, and Ford knowingly selling a fleet of armored vans after being told that their client is a known bank robber.
Legal requests should go through Legal channels. You can have all the evidence you want, but do you really want the justice system involved to be administered by a registrar? No. You don't. You want it to go through the actual Justice system.
If you should be upset with anyone, it's your local police who didn't escalate the case further.
I had exactly the same experience recently with Namecheap too, I guess this is why the scammers use them.
As a counterpoint to that a few weeks ago I reported a Bitcoin giveaway scam site to Namecheap and it was NXDOMAIN later that day.