Customer says its losing $70,000 in daily revenue from one of the domains.
[Update: On Thursday afternoon, a judge denied the request for a temporary restraining order on the grounds that it lacks personal jurisdiction and it has not shown why TrustName shouldn’t be given an opportunity to respond.]
Oath Research, LLC, has sued (pdf) domain registrar FewMoreTaps, d/b/a TrustName, after its domains were stolen from the registrar.
Several TrustName customers have claimed that domains were stolen from their accounts shortly after TrustName received a de-accreditation notice from ICANN.
The “bulletproof” registrar claimed it would help companies protect domains in industries that often “face false or bad-faith abuse reports.” ICANN sent it a termination notice because the registrar was not handling abuse complaints appropriately.
Customers who had their domains stolen report having two-factor authentication on their accounts. Despite this, someone was able to steal the domains and transfer them from the Estonian domain registrar. The domains have ended up at the Chinese domain registrar NiceNic.
Oath Research alleges that the thief initiated transfers on 25 of its domain names. The company said one of the stolen domains generated $70,000 in daily revenue.
As an initial step, the company is asking the court for a temporary restraining order and preliminary injunction.
Quick update since Andrew wrote this: oathresearch.com isn’t at NiceNIC anymore. It moved to REG.RU in Russia this morning. It had been at NiceNIC for two days. We still don’t have control.
Watched the whole thing happen on my monitor. NiceNIC put a transfer lock on it at 4:25 UTC, actually put my nameservers back on Cloudflare at 5:20 so my site came back up, then the lock came off at 10:15 and by 2:52 pm UTC it was gone to REG.RU. REG.RU locked it 20 minutes later.
How does a name get a 60 day post transfer lock at every registrar I’ve ever used, but not here? They knew it was stolen. They got served with the lawsuit on Sept 1. We had an open ticket with them on this exact domain. They locked it, then unlocked it, same morning. And the thief already renewed it out to 2036 the day before, so good luck ever transferring it anywhere.
Estonia to Hong Kong to Russia in six days. 14 more of mine still sitting at NiceNIC. Where is Verisign?
If you had domains taken from Trustname and they’re moving again, say so here. Nobody at any of these registrars is going to piece the pattern together for us.
“Where is Verisign?” – They are in the Eastern District of Virginia, and not New Jersey.
What was the reason for going with Trustname in the first place? They had a reputation for being sketchy with their “bulletproof” activities… or was that desirable for you?
I’m also curious, I looked at the filing, you didn’t name the owner (Kiryl Nestsiarovich) as a defendant personally, how come?
In hindsight, the wrong call. Obviously.
Who gets named where is counsel’s call, this probably isn’t the place to discuss strategy.
“What was the reason for going with Trustname in the first place?” – Because he’s engaged in the sale of peptide “research chemicals” for which there is a surprisingly large market of individuals engaged in “research”. This is from a Reddit thread posted by one of the “researchers” the plaintiff sells to:
“Ordered BPC157 and TB500. Is Oath legit? Can i use research water in place of bacteriostatic water? I’m very new to this looking to heal an injury. Any help would be greatly appreciated.
I know how to reconstitute it from what I read online and I’m good with measuring. I understand the difference between a milligram and a microgram, but I’ve never injected myself with anything before. What kind of syringes do I need I’ve heard injecting near the injury.”
Unsurprisingly, a lot of legitimate domain registrars and hosting companies will not provide services to these thinly-veiled pharmaceutical sales operations. That’s why they were at Trustnames in the first place, and they know it.
Still at NiceNIC as of now — TrustName → Dynadot (30 Aug) → NiceNIC (2 Sep).
Given what you’ve just described I’ll be checking the registry several times a day rather than once. Thanks for posting the timings — the lock going on and coming off the same morning is the part that matters.
Thanks, this helps. Dynadot was their first attempt for us as well but was cancelled. Save everything you have, every email, notice and record, however small. Setup automatic monitors. We should get in touch and compare notes privately.
Agreed on all three counts — I’ve been archiving everything, including registry snapshots at each stage.
Best way to reach me is ijontichy997 at gmail.com. I’ll send you what I have and would be glad to see what you’ve got.
One thing from my side that may be worth comparing straight away: mine went TrustName → Dynadot (30 Aug) → NiceNIC (2 Sep) and is still there. Interesting that Dynadot was attempted for you and cancelled — I’d like to know what stopped it, because nothing stopped mine.
Sad to hear that. And the owner of the domain modafinilxl.com actually stole the domains. Most of the stolen domains now redirects to either modafinilxl.com or their new sites with same DNS. The moment ICANN removed trustname’s accreditation, they paid Vitali (+375292964411) who is the actual owner of trustname/fewmoretaps. Kiryl Nestsiarovich is a documented name later on so that he can save his ass if anything goes wrong because the the fact is trustname was shady. And then slowly redirected all the sites towards different NS. If the site modafinilxl.com is attacked then things might come in place. Keep reporting their sites: modafinilxl.com, afinil.com, buygenerics.com to ICANN and the registrars continuously. They keep changing that so they can be online. You can also report your own sites to ICANN for the illegal and unauthorized transfers section which were pulled off by them. If required involve law enforcement too.
Unbelievable, what a very sad state of affairs, sorry you’ve been put through this Jon.
FYI, Andrew did not write the comment under the name “DNW”
Seems like many sites have now redirected to modafinilXL dot com and it is clear they are the thieves!
Some of mine redirecting to buygenerics dot com. It would appear from my rudimentary research that these pharmacy websites are controlled by the same people that run trustname.
The 2FA part is what really gets me — if 2FA didn’t stop it, this probably wasn’t a simple phishing/credential leak. It points more to either an insider at the registrar or a real gap in how TrustName handled transfer locks after the ICANN termination notice. That timing feels like the real story here: domains getting stolen right after a de-accreditation notice suggests the registrar either lost control of its own systems in the chaos, or someone inside knew the window was closing and moved fast. Either way, there’s a real irony in a “bulletproof” registrar marketing itself on protecting people from bad-faith abuse reports while apparently failing at basic transfer security. Worth a reminder for anyone parking high-value domains at lesser-known registrars.
A few days ago, ModafinilXl.com was transferred from TrustName.com to Paknic.com. Before being transferred to TrustName.com, ModafinilXl.com was also registered with Paknic.com.
When Paknic.com received a complaint from ICANN, Paknic.com transferred the domain to another registrar company that it also owns. Since 2016, ModafinilXl.com has been registered with Paknic.com.
TrustName.com and Paknic.com have the same owner, and the owner of both companies also owns ModafinilXl.com.
I am a worker at TrustName.com and Paknic.com. You can verify that ModafinilXl.com was recently successfully transferred to Paknic.com.
ModafinilXl.com is illegally selling prescription modafinil to customers in the United States and some other countries. You can also check LegitScript.com, which indicates that ModafinilXl.com is operating an illegitimate business.