TrustName clients note domain thefts following ICANN de-accreditation notice

Clients question TrustName’s response to alleged unauthorized transfers.

A number of clients of TrustName, a domain registrar that received a de-accreditation notice the prior week, claim that their domains have been stolen from the registrar.

ICANN informed Fewmoretaps OU, d/b/a TrustName.com, the prior week that it would be de-accredited for its handling of abuse complaints.

The firm pitched itself as a “bulletproof” registrar that would stand up for registrants who were likely to “face false or bad-faith abuse notes.”

Now, some clients are reporting that their domains have been stolen from the registrar in the wake of the de-accreditation notice.

Ijon Tichy told Reglike that the day following the breach notice, some domains were pushed out of client accounts to a single receiving account at the same registrar, then transferred to other registrars.

He stated his domain was pushed to another TrustName account on August 28. He reached out to the registrar a number of times over the next few days, asking the registrar to add a transfer lock on the domain, but the registrar did not. The domain was transferred to Dynadot on August 30.

Tichy stated he had two-factor authentication on his account. He can no longer log in; his password is accepted, but the two-factor code does not work.

Other clients are reporting the same issue.

They claim that two-factor authentication was on their accounts, and the receiving account for the domains was modastores@proton .me.

Tichy stated that TrustName told him there were logins from Dushanbe, Tashkent, and Karachi, and relied on that apparent geographic spread (specifically that the receiving party accepted the push “from a different IP address and location”) to say that it could not conclude the transfers were unauthorized. He wrote:

I checked all four addresses against public registry data:

187.40.39.41 AS212238 (Datacamp) “Packethub Tajikistan” → Kelsterbach, Germany
187.15.124.30 AS212238 (Datacamp) “Packethub Uzbekistan” → Kelsterbach, Germany
187.40.236.9 AS212238 (Datacamp) “Packethub Pakistan” → Singapore
187.40.236.43 AS212238 (Datacamp) “Packethub Pakistan” → Singapore

One autonomous system, four commercial VPN exit nodes, two data centres. The country names are VPN pool labels, not locations. The session that logged into my account and the session in which the “buyer” accepted the transfer both resolve to the same facility in Germany, minutes apart. The geographic separation the registrar relied on doesn’t exist.

Dynadot told Tichy to file a Transfer Dispute Resolution Policy claim with TrustName.

But with TrustName’s de-accreditation becoming official on September 11, Tichy wonders what happens to disputed domains during the de-accreditation window, when domains are transferred to another registrar through ICANN’s De-Accredited Registrar Transition Procedure.