AS22612

AS22612 is the autonomous system operated by Namecheap, Inc., a major ICANN-accredited domain registrar and web-hosting provider registered under ARIN with the handle AS22612 and the network name NAMECHEAP-NET. The ASN was registered with ARIN on 2011-06-21 (autnum top-level registration event) and last changed 2012-03-02. Namecheap runs a content/hosting network — shared, VPS and dedicated hosting plus SSL, email and CDN services — and is one of the largest registrars in the world, managing roughly 10 million domains and around 11 million customers as of 2022. Routing-wise the AS is a transit-buying network: it originates on the order of 337–343 IPv4 prefixes (~80,000–90,000 addresses) and roughly 6 IPv6 prefixes, with a CAIDA AS Rank near 13,353 and a customer cone that is essentially the AS itself (no downstream customers). It buys transit from ~14 upstreams, including Cogent (AS174), Hurricane Electric (AS6939), TATA (AS6453) and GTT (AS3257), and runs an open peering policy per PeeringDB (5–10 Gbps, mostly outbound, North America scope). Its address footprint is primarily US-based with smaller European and APAC blocks. The security picture is the most important triage point: AS22612 carries an above-average historical abuse burden driven by its scale and low-cost model. The UK NCSC's Active Cyber Defence report named Namecheap as hosting up to ~60% of gov.uk-themed phishing by December 2020, though takedown times improved sharply through 2021; and APWG has repeatedly ranked Namecheap the single most-used registrar for BEC domain registration (36% in Q1 2024, 40.7% in Q2 2024, still #1 in Q1 2025). CleanTalk spam rates (~0.25–3.2%, depending on the snapshot) are consistent with the shared-hosting category and not elevated for the provider's size. No ASN-level Spamhaus DROP/ASN-DROP or major threat-feed block listing was found as of June 2026, and the network is not classified as bulletproof hosting in any public source consulted.

Operator

Namecheap, Inc. (commercial domain registrar + shared/VPS/dedicated hosting; ARIN handle AS22612 / org NAMEC-4) [Confirmed] — ARIN RDAP, en.wikipedia.org/wiki/Namecheap

Country / RIR

US, ARIN [Confirmed] — ARIN RDAP autnum (country US), RIPEstat abuse-contact-finder

Allocated

2011-06-21 (ARIN registry date from autnum TOP-LEVEL registration event, NOT a nested org/contact event and NOT an IEEE date); last changed 2012-03-02 [Confirmed] — ARIN RDAP autnum top-level events (handle AS22612, name NAMECHEAP-NET)

Org status

private company; majority stake acquired by CVC Capital Partners (Sep 2025), founder Richard Kirkendall retained a substantial share. Incorporated as Namecheap, Inc.; ARIN registered address 11400 W. Olympic Blvd. Suite 200, Los Angeles, CA 90064, US (operational HQ reported as Phoenix, AZ) [Confirmed for incorporation/address; corporate ownership Confirmed via Wikipedia] — en.wikipedia.org/wiki/Namecheap, ARIN RDAP

Contacts

abuse@namecheaphosting.com (POC ABUSE2885-ARIN); tech@namecheaphosting.com; arin-admin@namecheap.com; registrant Namecheap, Inc. (NAMEC-4) [Confirmed] — ARIN RDAP, RIPEstat abuse-contact-finder

Security/abuse context (ELEVATED-HISTORICAL, DATED)

UK NCSC ACD reports — Namecheap hosted up to ~60% of gov.uk-themed phishing by Dec 2020 (28.8% of UK-gov phishing that year), takedown times improved sharply by April 2021 (median availability 66h → <2h). APWG ranks Namecheap the #1 BEC-domain registrar (36% Q1 2024, 40.7% Q2 2024, still #1 Q1 2025). Feb 2023: phishing emails (DHL/MetaMask) sent via Namecheap's upstream email provider (SendGrid); Namecheap stated its own systems were not breached. CleanTalk spam rate consistent with shared-hosting category (~0.25–3.2% across snapshots), not elevated for scale. No ASN-level Spamhaus DROP/ASN-DROP listing found as of June 2026; not classified as bulletproof hosting [Confirmed for NCSC/APWG/incident; Likely for current threat-feed absence] — ncsc.gov.uk ACD reports, docs.apwg.org trends reports, cleantalk.org/blacklists/as22612, bleepingcomputer.com, spamhaus.org

Network & routing

Network type

content / hosting provider (domain registrar; shared, VPS, dedicated web hosting; SSL; CDN; email hosting) [Confirmed] — peeringdb.com/asn/22612, bgp.tools/as/22612

Size

~337–343 IPv4 prefixes (~80,000–90,000 addresses) and ~6 IPv6 prefixes; CAIDA customer cone = 1 ASN (itself), ~82,048 addresses, no downstream customers [Confirmed for counts; ranges reflect snapshot variance] — RIPEstat routing-status, CAIDA AS Rank, bgp.he.net

Routing/peering

Active and fully announced — visible to all RIS peers (v4/v6). ~14 upstream providers (CAIDA asnDegree.provider=14); named upstreams: Cogent (AS174), Hurricane Electric (AS6939), TATA (AS6453), GTT (AS3257), Incapsula/Imperva (AS19551), Unitas Global (AS11855), PhoenixNAP (AS59210) [Confirmed for activity/upstream count; named upstreams Likely via bgp.he.net/bgp.tools]. Open peering policy, no ratio requirement, 5–10 Gbps mostly outbound, North America scope, no route servers

[Confirmed] — peeringdb.com/asn/22612

RPKI

ROA coverage reported across announced routes (community sources note high/valid coverage, e.g. 343/343 valid); not independently re-validated per-prefix this run [Likely] — bgp.he.net/AS22612, bgp.tools/as/22612

AS Rank

~13,353 (CAIDA AS Rank); CAIDA marks it cliqueMember but topology shows 14 providers / 0 customers / 0 peers, i.e. a transit-buying stub [Confirmed] — api.asrank.caida.org

Geo footprint

primarily United States; smaller European (185.61.152.0/22, 2a02:77e0::/44) and APAC (203.161.32.0/19, 159.198.32.0/20) blocks [Likely] — CAIDA, RIPEstat announced-prefixes, ARIN RDAP

Notable usage

one of the largest ICANN-accredited registrars (~10M domains, ~11M customers as of 2022); founded 2000 by Richard Kirkendall. In September 2025, CVC Capital Partners acquired a majority stake (~$1.5B valuation); CEO transition followed [Confirmed for registrar scale/history; corporate-event details Confirmed via Wikipedia] — en.wikipedia.org/wiki/Namecheap, bgp.tools/as/22612

Analyst note

Large commercial registrar/hosting ASN. Allocation date taken from the RDAP autnum top-level event (2011-06-21); the nested NAMEC-4 org (2011-01-28) and contact registrations (2011-01-24/25) are decoys and were not used. Above-average but improving historical abuse burden tied to scale and low-cost model, not a documented tolerance policy.