A federal judge in Arizona has given the domain registrar Namecheap until today, October 12, 2026, to explain in writing why it should not reimburse a law firm’s legal costs after letting a domain under active litigation lapse and change hands. The order tests whether a registrar that fails to freeze a domain during a court case can still claim the legal immunity the Anti-Cybersquatting Consumer Protection Act (ACPA) normally gives registrars that stay neutral.

What Judge Liburdi Ordered on September 28

Judge Michael T. Liburdi of the U.S. District Court for the District of Arizona issued a show-cause order on September 28, 2026, in Greenberg Gross LLP v. GreenbergGrossLLP.com, No. CV-25-01176-PHX-MTL — an in rem action, meaning the lawsuit targets the domain name itself rather than a specific person, a mechanism used when the registrant’s identity is unclear or outside U.S. jurisdiction. The order gives Namecheap, a non-party to the underlying case, no more than ten pages to justify why it should not cover at least $50,385.55 in costs the law firm says it incurred because of the registrar’s conduct.

The judge did not mince words about the record so far: the plaintiff, Liburdi wrote, “has presented ample evidence that Namecheap violated its obligations under the ACPA.” The statute bars a registrar from transferring, suspending, or otherwise modifying a domain “during the pendency of the action, except upon order of the court” — a duty that exists precisely so a disputed domain cannot quietly move while a court decides who should own it.

April 2025 to September 2025: How a Frozen Domain Unfroze Itself

The law firm filed its in rem complaint on April 8, 2025, and served an amended complaint on Namecheap on April 23, 2025 — the point at which, under the ACPA, the registrar’s non-modification duty attached. Namecheap has told the court it never received a litigation hold request, and did not independently restrict the domain.

The prior registration, held by an entity called Diverse ISP, lapsed on July 31, 2025. On September 9, 2025, Namecheap registered the now-available domain to a new customer, Belvana Sela, through a privacy service that anonymized the new owner’s contact details — with an active federal lawsuit over that exact domain still open on the docket.

October 2025 to March 2026: Three Explanations, No Reimbursement

When the law firm asked Namecheap on October 21 and 22, 2025, to identify the new registrant, the company declined without a subpoena or court order. It complied only after being subpoenaed, naming the registrant on December 8, 2025 — more than four months after the lapse. Namecheap offered three separate explanations for its conduct, on March 9, 20, and 27, 2026, each of which the plaintiff’s motion disputes point by point. By late March, Namecheap had told the firm its refusal to reimburse the resulting costs was final. One of its stated positions — that it “did not confirm receipt of a court order requiring the restriction of the subject domain” — is the line the judge now wants defended in writing, since the amended complaint he cited is not the same thing as a separate restriction order, but the statute’s own wording does not appear to require one.

Why the ACPA’s Registrar Shield Has a Hole In It

Registrars are not normally liable for what happens to a disputed domain — that is the entire point of ACPA Section 1125(d)’s registrar-immunity provision, which lets a company like Namecheap host billions of domains without becoming a party to every trademark fight over one of them. But the statute withholds that immunity “in the case of bad faith or reckless disregard,” and Liburdi flagged the anonymized re-registration as evidence worth testing against that standard: the move, he wrote, “suggests that Namecheap knew of this pending action.”

That distinction matters well beyond one Arizona docket. Every platform now selling scarce names — Fragment, the Telegram-affiliated marketplace that auctions @usernames on the TON blockchain; WhatsApp’s in-progress username rollout; X’s handle marketplace for dormant accounts — is, functionally, running its own registry with its own version of a lock-and-transfer duty. None of them currently face a body of case law anywhere close to the ACPA’s twenty-five years of registrar litigation. This case is the closest thing to a live test of what a court expects a name-issuing intermediary to actually do once it is on notice of a dispute, rather than what its terms of service say it will do. A ruling against Namecheap would be the first modern data point platform counsel at Fragment, Meta, or X could not credibly ignore.

Key takeaways

  • A federal judge has ordered registrar Namecheap to justify, by October 12, 2026, why it should not pay a law firm’s costs after letting a domain under active litigation lapse and re-register to a new, privacy-shielded owner.
  • The case turns on a four-month gap between a 2025 amended complaint and Namecheap confirming the new registrant’s identity — and on whether anonymizing that registrant counts as the “bad faith or reckless disregard” that strips a registrar of ACPA immunity.
  • Namecheap’s own defense is that it never received a specific restriction order distinct from the amended complaint — a reading of the statute’s notice requirement the court has now asked it to defend in writing.
  • Brand and IP teams relying on an in rem filing to freeze a disputed domain should confirm the registrar has acted on it, rather than assuming service of the complaint alone accomplishes a lock.
  • The ruling, whichever way it goes, will be the clearest legal signal yet for how courts expect any name-issuing platform — domain registrar or username marketplace — to behave once it is on notice of a live dispute over a name it controls.