Several TrustName customers say domains were pushed out of their accounts and transferred away without permission, with some reporting that two-factor authentication was enabled. The claims surfaced after ICANN terminated the accreditation of Fewmoretaps OU d/b/a Trustname.com, effective 11 September 2026.
Ech’s short answer
Domain Name Wire reported on 1 September that multiple TrustName customers say domains were moved out of their accounts without permission. At least one customer said a domain was pushed to another TrustName account and later transferred to Dynadot despite repeated requests for a transfer lock. ICANN’s decision to terminate TrustName’s accreditation was separate and was based on unresolved DNS-abuse compliance failures.
TrustName is facing a new problem just days after receiving an ICANN termination notice: several customers are now alleging that domains were removed from their accounts without authorisation and, in some cases, transferred to other registrars.
The reports are serious, but they need to be described carefully. ICANN did not terminate TrustName because of these alleged domain thefts. Its 27 August notice concerned repeated failures to investigate and mitigate DNS abuse. The customer transfer allegations emerged around the same period and are a separate issue that is still being disputed.
Domain Name Wire says multiple customers have reported similar incidents, including accounts where two-factor authentication was enabled.
Domain Name Wire reported on 1 September that several TrustName customers claim domains were moved from their accounts after ICANN’s termination notice. The report describes domains first being pushed internally to another TrustName account before some were transferred to outside registrars.
One customer, Ijon Tichy, told the publication that his domain was pushed to another TrustName account on 28 August. He said he contacted the registrar several times and asked for a transfer lock to be applied, but the domain was subsequently transferred to Dynadot on 30 August.
Tichy also said two-factor authentication had been enabled on his TrustName account. Other customers quoted or referenced in the report made similar claims about 2FA and unauthorised account activity.
According to Domain Name Wire, TrustName pointed to logins associated with different apparent locations and said it could not conclude that the transfer was unauthorised. Tichy argued that the IP addresses were commercial VPN exit nodes and did not demonstrate genuinely separate physical locations. That disagreement has not been independently resolved.
Customers are alleging domain theft and unauthorised transfers, but the public evidence currently consists of customer reports, registrar communications and transfer records described by third parties. It would be premature to state that TrustName, an employee or any specific person was responsible for the alleged thefts without a completed investigation or formal finding.
The termination notice was issued on 27 August and becomes effective on 11 September 2026.
TrustName is the trading name of Fewmoretaps OU, an Estonia-based registrar with IANA registrar ID 4318. ICANN’s 27 August notice says the company’s Registrar Accreditation Agreement is terminated under sections 5.5.4 and 5.5.6 of the agreement, with the termination becoming effective 11 September 2026.
ICANN said breach notices issued on 10 June and 26 June had not been fully cured. The remaining violations included failures to take prompt and appropriate action to stop or disrupt registered domains being used for DNS abuse, and failures to reasonably and promptly investigate and respond to abuse reports.
The termination notice also says TrustName received four notices of fundamental and material breach over a 78-day period: 10 June, 26 June, 16 July and 26 August 2026. ICANN said repeated remediation measures had not demonstrated effective compliance.
ICANN issued an initial formal breach notice focused heavily on TrustName’s handling of DNS-abuse reports.
A further breach notice addressed additional abuse-handling cases and unresolved compliance issues.
Further breach notices meant ICANN counted four fundamental and material breaches within 78 days.
ICANN issued the termination notice, with the accreditation scheduled to end on 11 September.
ICANN’s termination letter is about DNS-abuse handling and repeated contractual breaches. The customer allegations about unauthorised transfers surfaced after the termination notice and should be treated as a separate developing story.
De-accreditation does not mean legitimately registered domains simply disappear, but disputed transfers may need to be handled separately.
ICANN’s termination letter says it will use its De-Accredited Registrar Transition Procedure to move domain names currently managed by TrustName to a qualified ICANN-accredited registrar. ICANN’s general guidance also states that names sponsored by a terminated registrar must be transferred to an accredited registrar.
That transition process is important for customers whose domains remain properly inside their TrustName accounts. It is a different issue from a domain that was allegedly transferred out to another registrar before the de-accreditation takes effect. A bulk transition of TrustName’s remaining portfolio would not necessarily reverse a disputed transfer that has already completed elsewhere.
At the time of writing, ICANN’s public bulk-transfer page did not yet list TrustName or Fewmoretaps OU. ICANN notes that bulk transfers caused by an accreditation termination take place after the termination date, so customers should watch for the gaining registrar to be announced as the 11 September date approaches and passes.
ICANN’s guidance says affected registrants should contact the registrar immediately and may submit an Unauthorized Transfer Complaint. In some cases, a registrar can initiate a dispute under the Transfer Dispute Resolution Policy. That process is distinct from the normal de-accredited registrar transition.
Owners do not need to assume their domains are affected, but the combination of the customer reports and the pending de-accreditation makes an immediate account check sensible.
Act quickly and keep the communication factual. Give both registrars the domain name, the transfer date, your account evidence and the reason you believe the transfer was unauthorised. Ask for written case numbers and preserve every reply. If the gaining registrar locks the domain during an investigation, that can at least reduce the risk of another rapid transfer while the dispute is reviewed.
ICANN specifically advises registrants who believe a domain was transferred without permission to contact the registrar immediately and submit an Unauthorized Transfer Complaint. It also notes that a registrar may in some circumstances initiate a dispute under the Transfer Dispute Resolution Policy.
Bottom line
ICANN has already decided to terminate TrustName’s accreditation over repeated DNS-abuse compliance failures, effective 11 September. Separately, customers are now reporting domains being pushed out of accounts and transferred without their permission. Those theft claims are not yet a formal finding, but affected owners should verify their domains, preserve evidence and use the registrar and ICANN complaint routes immediately if anything has moved unexpectedly.
