Fewmoretaps OU, the Estonian company behind the TrustName domain registrar, has lost its ICANN accreditation. The decision came after the company failed to adequately respond to three breach-of-contract notices received since the beginning of the year.
TrustName had positioned itself as a “bulletproof” registrar, one that would defend registrants facing what it called “false or bad-faith abuse reports.” The company claimed it would only remove domain names pursuant to court orders from the three jurisdictions in which it operates: the United States, Estonia, and the Federation of Saint Kitts and Nevis.
This approach, however, directly conflicts with ICANN's Accreditation Agreement, which requires registrars to take appropriate action in response to valid abuse complaints. And there were plenty of such complaints: domains registered through TrustName were used in phishing campaigns impersonating banks and tax authorities. Since the registrar failed to act, ICANN stepped in itself: effective September 11, TrustName is no longer authorized to operate as a domain registrar.
The situation has since gone from bad to worse. According to Domain Name Wire, several customers have reported that their domains were stolen from TrustName in the wake of the de-accreditation announcement and transferred to other registrars. One such registrant, who goes by the pseudonym Ijon Tichy, said his domain was moved to another TrustName account. He contacted the registrar multiple times over the following days, requesting a transfer lock, but the registrar did not act. On August 30, the domain was transferred to Dynadot.
Tichy says he had two-factor authentication enabled on his account. He can no longer log in – his password is accepted, but the two-factor code no longer works. Other customers are reporting the same issue. They also claim that two-factor authentication was active on their accounts, and that the receiving account for the stolen domains was modastores@proton.me.
Tichy added that TrustName told him there had been logins from Dushanbe, Tashkent, and Karachi, and used the apparent geographic spread – specifically that the receiving party accepted the transfer “from a different IP address and location” – to argue that it could not conclude the transfers were unauthorized. He wrote:
“I checked all four addresses against public registry data:
187.40.39.41 AS212238 (Datacamp) "Packethub Tajikistan" → Kelsterbach, Germany
187.15.124.30 AS212238 (Datacamp) "Packethub Uzbekistan" → Kelsterbach, Germany
187.40.236.9 AS212238 (Datacamp) "Packethub Pakistan" → Singapore
187.40.236.43 AS212238 (Datacamp) "Packethub Pakistan" → Singapore
One autonomous system, four commercial VPN exit nodes, two data centers. The country names are VPN pool labels, not locations. The session that logged into my account and the session in which the ‘buyer’ accepted the transfer both resolve to the same facility in Germany, minutes apart. The geographic separation the registrar relied on doesn’t exist.”
Dynadot advised Tichy to file a Transfer Dispute Resolution Policy claim with TrustName. But with TrustName’s de-accreditation taking effect on September 11, the fate of domains transferred under these circumstances raises serious concerns.
