Trustname.com / Fewmoretaps OÜ

Registrar Zone Evidence — Phase II

⚖️ “Bulletproof” Has an Expiry Date

_{TRUSTNAME · IANA #4318 · ACCREDITATION TERMINATED · Verified 26 October 2026}

Trustname described itself as a “bulletproof domain registrar.” On 11 September 2026, its ICANN accreditation ended. The official IANA record now gives the outcome in a single word: Terminated.

10 JUN 2026	27 AUG 2026	11 SEP 2026
First formal breach notice	Termination notice	Accreditation ended

NiceNIC, the precedent is now on the record.

  ICANN enforcement · full statement and official sources

We have been blunt with ICANN when enforcement falls short. Fairness demands that we be just as clear when it delivers. In the Trustname case, ICANN Contractual Compliance deserves credit for both the decision and the pace.

Seventy-eight days from the first formal breach notice to the termination notice. Fifteen more days for the decision to take effect. The fourth breach notice was followed by the decision to terminate the very next day. That is a pace of formal enforcement worth acknowledging.

ICANN gave Trustname opportunities to put its abuse handling right. It examined the responses, documented recurring failures, and brought the accreditation agreement to an end. The decision makes the stakes plain: a registrar that repeatedly fails to investigate abuse reports and act against DNS abuse can lose its place in the accredited system.

For the people documenting phishing, reporting it, and waiting for someone to act, that consequence matters. It also gives responsible registrars a reason to believe that the obligations they meet will be enforced across the industry.

Thank you to the ICANN team that saw this through. The work deserves recognition, and the precedent deserves to be followed.

That brings us to NiceNIC. Our complaint and supporting evidence are public. They deserve the same scrutiny, the same urgency, and the same willingness to impose consequences if repeated breaches are established. We will keep asking for that standard to be applied.

Read the official enforcement record · Notices, grounds and dates

Date	Primary source
10 June 2026	First Notice of Breach
26 June 2026	Second Notice of Breach
16 July 2026	Third Notice of Breach
26 August 2026	Fourth Notice of Breach
27 August 2026	Notice of Termination
11 September 2026	Effective date specified in the termination notice

The termination notice records four Notices of Breach over 78 days, citing failures under RAA §3.18.1 to investigate and respond appropriately to abuse reports and §3.18.2 to take prompt, appropriate action against DNS abuse. Termination followed under §§5.5.4 and 5.5.6. The intervals highlighted above measure the formal breach-to-termination stage; the notice also documents earlier compliance engagement.

For phishing responders, the notice contains a particularly useful finding: Trustname acknowledged that it had improperly demanded proof that credentials had actually been collected or transmitted, instead of assessing whether the available evidence, taken together, reasonably supported a phishing determination.

The notice also provides for transferring the registrar's domains to a qualified ICANN-accredited registrar to protect registrants. All five notices are listed in the ICANN enforcement index.

_{The June 2026 investigation below predates termination. Its live feed tracks the research dataset; it does not establish current accreditation or current registrar sponsorship for every tracked domain.}

🔴 LIVE INVESTIGATION FEED · Auto-updated · Last fetch 2026-11-07

📦 Domains tracked 14,910	💰 Est. annual value $120,245
📡 Deployed 53.1%	✅ IOC classified 4,276 (3,293 HIGH)
⚡ Registered ≤7d 0.0%	🕵️ Serial regs 0

Live analytics · TLDs, hosting, registrations and downloads

🏷️ Top TLD Zones

TLD	Count	Avg reg→expiry	Est. annual value
.com	9,475	403d	$85,180
.icu	963	365d	$953
.net	789	438d	$7,882
.org	683	411d	$6,823
.latino	630	365d	$3,144
.pro	239	375d	$1,910
.live	225	382d	$2,248
.cyou	193	365d	$191
.cam	176	365d	$878
.cfd	155	365d	$773

🌍 Top Hosting Countries

US  ██████████████████        974 (54.0%)
DE  ███░░░░░░░░░░░░░░░        179 (9.9%)
AE  ██░░░░░░░░░░░░░░░░        148 (8.2%)
NL  █░░░░░░░░░░░░░░░░░        101 (5.6%)
FR  █░░░░░░░░░░░░░░░░░         66 (3.7%)
MD  ░░░░░░░░░░░░░░░░░░         44 (2.4%)
RU  ░░░░░░░░░░░░░░░░░░         43 (2.4%)
GB  ░░░░░░░░░░░░░░░░░░         41 (2.3%)

📈 Registration Burst Days

Date	Domains	× Average
2026-06-12	579	18.3× 🚨
2026-07-13	294	9.3× 🚨
2026-06-15	227	7.2× 🚨
2026-06-25	217	6.8× 🚨
2026-07-22	217	6.8× 🚨

🎯 Top Targeted Brands & Keywords

trust (95) · swap (65) · secure (56) · wallet (53) · crypto (38) · login (35) · verify (34) · support (34) · connect (33) · account (32) · bridge (23) · ledger (19) · official (18) · bitcoin (17) · farm (15)

📥 Download Threat Intelligence

File	Format	Description
data/all.txt	TXT	All tracked domains
data/index.json	JSON	Full analytics snapshot
data/ioc/serial_registrants.json	JSON	Repeat registrants + their domains
data/ioc/shared_ips.json	JSON	Shared hosting clusters
data/ioc/brand_domains.json	JSON	Domains by targeted brand
data/ioc/stix-bundle.json	STIX 2.1	MISP/OpenCTI bundle (HIGH IOC domains, up to 10k)
data/ioc/serial_emails.txt	TXT	grep-friendly: email⇥count
data/ioc/shared_ips.txt	TXT	grep-friendly: ip⇥count⇥country

📊 Live web dashboard: see Pages link at top · Updated daily 02:00 UTC

_{TRUSTNAME / INVESTIGATION INDEX}

Full table of contents · 13 sections

Investigation

• “Bulletproof” Has an Expiry Date — ICANN enforcement
• 1 · Background
• 2 · Subject
• 3 · Scope and Coverage
• 4 · Methodology

Evidence

• 5 · Headline Findings
• 6 · Operator Clusters
• 7 · Evidence Archive
• 8 · Notable Confirmed Cases

Legal / Reuse

• 9 · Enforcement Posture
• 10 · Repository Structure
• 11 · Mirrors
• 12 · Citation & License

  Investigation · background, subject, scope and methodology

1 · Background

This repository is the Phase II evidence package of the PhishDestroy investigation into Trustname.com / Fewmoretaps OÜ (IANA registrar ID #4318).

Phase I — operator profile and corporate forensics is published as a standalone article on the PhishDestroy site: 📰 phishdestroy.io/trustname-bulletproof-exposed

This README does not duplicate Phase I material. Refer to the Phase I article for entity, officer, financial, and infrastructure findings.

Phase II — this repository — quantifies the abuse footprint by enumerating every domain in the registrar's zone. Rather than sampling, every domain is processed through a four-stage technical pipeline:

       ╭────────────────────╮      ╭────────────────────╮      ╭────────────────────╮      ╭────────────────────╮
       │   1. AWS Lambda    │ ───▶ │  2. Headless       │ ───▶ │  3. CF Deep Scan   │ ───▶ │  4. AI            │
       │   HTTP fingerprint │      │     Browser render │      │     + 2captcha     │      │     classification │
       │   80 conc / inv.   │      │     Playwright     │      │     SOCKS5 pool    │      │     Llama 3.1     │
       ╰────────────────────╯      ╰────────────────────╯      ╰────────────────────╯      ╰────────────────────╯
              18,719                       18,719                       2,182                       2,434
              domains                     domains                     protected targets           classified

Phase II in one sentence: in the June 2026 scan, of the 12,088 domains under this registrar that actually served content, 4,275 (35.4%) were confirmed malicious — phishing, carding, crypto drainers, malware distribution, illegal-drug sales, and unlicensed gambling. A further 6,616 of the 18,719 scanned domains were dead or parked. The complete per-domain dataset, screenshots, and operator-cluster analysis live in this repository.

---

2 · Subject

Field	Value
🏢 Legal entity	Fewmoretaps OÜ
🌐 DBA	Trustname.com
🆔 ICANN / IANA ID	#4318
Accreditation status	Terminated, effective 11 September 2026 — ICANN notice · IANA registry
🇪🇪 Jurisdiction	Estonia (EU)

Operator identity, corporate-registry details, and financial profile are covered in Phase I: phishdestroy.io/trustname-bulletproof-exposed

---

3 · Scope and Coverage

Parameter	Value
📆 Scan window	June 2026
📊 Domains in scope	18,719 — all domains under registrar management at scan time (the zone has grown since; see the live counter above)
🎯 Sampling	None — complete-zone enumeration
🌐 Network coverage	Full HTTP + headless browser for every domain
☁ Cloudflare-protected	2,072 domains identified in the enriched dataset
🧩 Phase 3 re-scan targets	2,182 blocked / challenged domains re-scanned via proxy + 2captcha
🧩 CAPTCHAs solved	92 (hCaptcha · reCAPTCHA v2/v3 · Cloudflare Turnstile)
📷 Screenshots captured	1,953
🤖 AI-classified content	2,434 domains
🛡 Threat-intel feeds	Spamhaus DBL · SURBL · URLhaus · ThreatFox

---

4 · Methodology

🔍 Phase 1 — HTTP Fingerprint (AWS Lambda)

Runtime	Python 3.11 + aiohttp, deployed to AWS Lambda
Concurrency	80 requests / invocation × 77 parallel invocations
User-Agent	Googlebot (cloaking bypass)
favicon_mmh3	MurmurHash3 32-bit of /favicon.ico — Shodan-compatible
server_fp	SHA-256 of server ‖ content-type ‖ x-powered-by
simhash	64-bit body SimHash for near-duplicate detection

🖥 Phase 2 — Browser Render (Playwright)

Runtime	Playwright 1.40 + playwright-stealth v2, headless Chromium
Isolation	new browser context per domain (prevents TargetClosedError cascade)
Capture	Full-page screenshot 1280 × 800, DOM dump, form-field inventory

Form-field semantic flags: seed_phrase · private_key · wallet_addr · card_number · cvv · iban · sort_code · routing_number · password · otp_2fa · recovery_email · ssn · passport_number · dob

☁ Phase 3 — Cloudflare Deep Scan

Scope	2,182 domains returning HTTP 403/503 from Phase 2
Proxy pool	2,600+ rotating SOCKS5 exits
CAPTCHA	2captcha API — hCaptcha · reCAPTCHA v2/v3 · Cloudflare Turnstile
Result	92 CAPTCHAs solved · 1,953 final screenshots

🤖 Phase 4 — AI Classification

Model	llama-3.1-8b-instant via Groq API
Input	(title, h1, meta_desc, body_text[:2000], form_labels)
Output	Natural-language description + category enum + severity score
DNSBL	Spamhaus DBL · SURBL
REST	URLhaus · ThreatFox (Abuse.ch)

---

  Evidence · findings, clusters, archives and confirmed cases

📊 Headline Findings

Metric	Value
🧮 Total domains scanned (June 2026)	18,719
💀 Dead / parked / error	6,616 (35.3 %)
💚 Active with content	12,088 (64.6 %)
🔴 HIGH severity	3,292
🟠 MEDIUM severity	983
⚠ Total malicious (HIGH + MEDIUM)	4,275
🚨 Malicious share of active content	35.4 %
☁ Behind Cloudflare	2,072
📷 Screenshots captured	1,953
🧩 CAPTCHAs bypassed	92

🔥 Of the domains in this registrar's zone that actually served content in June 2026, more than 1 in 3 was confirmed malicious.

ℹ️ The table above is the June 2026 scan snapshot. The published blocklist in ioc/ currently lists 4,276 domains (3,293 HIGH, 983 MEDIUM) — the live figure is in the IOC classified counter at the top. The per-row severity_label in data/enriched.csv / docs/data.json (3,047 HIGH · 1,107 MEDIUM · 13 CRITICAL across 19,063 rows) is the raw classifier output for the enriched subset only and is not the blocklist.

Category Breakdown

	Category	Count	Severity	Description
🦠	MALWARE	1,903	🔴 HIGH	Threat-intel feed detections (page_type=FEED_DETECTED; not HTTP-scanned)
🎰	GAMBLING	733	🟠 MEDIUM	Unlicensed casino/betting; Turkish bahis cluster
🎣	PHISHING_GENERIC	396	🔴 HIGH	Credential harvesting (login, OTP, password)
🏦	PHISHING_FINANCE	236	🔴 HIGH	Bank/card/CVV harvesting
💳	CARDING	182	🔴 HIGH	Clone-card shops, dumps markets, money-mule
🪙	PHISHING_CRYPTO	178	🔴 HIGH	Wallet/exchange phishing (Ledger, Solflare, Pump.fun)
🎭	CRYPTO_SCAM	146	🔴 HIGH	Fake investment platforms, "Elon Musk" casinos
☣	MALWARE_DIST	105	🔴 HIGH	RAT shops, crackware, fake firmware updaters
™	BRAND_ABUSE	83	🟠 MEDIUM	Brand impersonation, typosquatting
🔞	ADULT	81	🟠 MEDIUM	Unlicensed adult content, escort/cams
🚰	CRYPTO_DRAIN	60	🔴 HIGH	Wallet drainers, seed-phrase forms
📨	SPAM_INFRA	56	🟠 MEDIUM	Email/SMS spam infrastructure
🔀	PROXY_VPN	48	🟠 MEDIUM	Proxy / VPN abuse services
💊	ILLEGAL_DRUGS	42	🔴 HIGH	Rx drugs without prescription
🔄	CRYPTO_MIXER	28	🔴 HIGH	Cryptocurrency mixing / laundering
🟢	ACTIVE	207	🟢 LOW	Responds, no confirmed malicious signal
🅿	PARKING	27	⚪ INFO	Parked / for sale
❌	ERROR	286	⚪ INFO	5xx, connection refused, no content
⚫	DEAD	4,745	⚪ INFO	No DNS / no response

📄 Category counts and full per-domain data: data/enriched.csv (19,063 rows)

---

🕸 Operator Clusters

Domains grouped by shared server fingerprint (SHA-256 prefix) and favicon MurmurHash3. Shared fingerprint = same hosting stack / same operator template — evidence of coordinated infrastructure, not unrelated registrants.

Cluster Key	Type	Domains	Primary Category
🔑 811e0897f489	server_fp	1,674	🎰 GAMBLING — Turkish bahis cluster
🔑 0ab5f121ab0d	server_fp	305	🎰 GAMBLING — multilingual casino
🔑 4492f7f3e69c	server_fp	161	💳 CARDING
🔑 d8c33640a2fc	server_fp	149	💳 CARDING
🔑 4b8db6e031cc	server_fp	122	🏦 PHISHING_FINANCE — 1xbet typosquats
🔑 24be2aa9d598	server_fp	104	❌ ERROR (dormant abuse infra)
🖼 -736095526	favicon_mmh3	88	🎭 CRYPTO_SCAM — "Elon" casino cluster — overlaps Phase I
🖼 1869784862	favicon_mmh3	34	🪙 PHISHING_CRYPTO — Solana drainer cluster
🔑 a1b77bce0100	server_fp	28	☣ MALWARE_DIST — Binance impersonation

🎯 A single server fingerprint 811e0897f489 accounts for 21.9 % of the 7,641 records in the June 2026 HTTP scan snapshot. The "Elon" favicon cluster identified here directly extends the six-domain operator group described in Phase I.

Full cluster data: case/CLUSTERS.md

---

📦 Evidence Archive

All artefacts are content-addressed by SHA-256 to support chain-of-custody verification.

Path	Size	SHA-256 (16)	Contents
📊 data/enriched.csv	4.67 MiB	7a4f8f7482ae2b83	Full enriched dataset — 19,063 domain records, all columns
📊 data/high_severity.csv	748.1 KiB	879d7ce799f2762f	HIGH-only filtered subset
📊 data/dead_domains.csv	742.4 KiB	5ee84646c6872591	Dead / parked / error enumeration
🚫 ioc/domains_high.txt	56.6 KiB	25cf3632c9c8bc15	Production blocklist — 3,293 HIGH domains
🚫 ioc/domains_all_malicious.txt	74.9 KiB	9b164c16d7cba3cc	HIGH + MEDIUM blocklist — 4,276 domains
🛡 ioc/indicators.csv	1.13 MiB	28e7becca58a117e	SIEM indicators — IP, server_fp, favicon_mmh3, category, severity
🔐 evidence/HASHES.txt	167.5 KiB	131ff258bd0c058c	SHA-256 of all 1,953 screenshots
📦 pkg/raw_data/enriched.csv.gz	778.8 KiB	f25a64bf35fcb018	Compressed enriched dataset
📦 pkg/raw_data/lambda_results.jsonl.gz	509.3 KiB	c0add17921efada8	Phase 1 — HTTP fingerprint raw output
📦 pkg/raw_data/deep_results.jsonl.gz	1.07 MiB	60b943f03e7ac926	Phase 2/3 — browser render raw output
📦 pkg/raw_data/threat_intel.jsonl.gz	74.2 KiB	4a92dafe955b60d4	Threat-intel cross-reference

📋 Detailed chain-of-custody documentation: PROVENANCE.md

🔍 Verification

# verify any archive
sha256sum pkg/raw_data/enriched.csv.gz
# expected prefix: f25a64bf35fcb018…

# verify all 1,953 screenshots against the manifest
cd docs/screenshots && sha256sum -c ../../evidence/HASHES.txt

---

🎯 Notable Confirmed Cases

Domain	Category	Evidence
💳 buyclonecards.bond	CARDING	Explicit clone-card shop, CVV dumps market
☣ thebtmob.com	MALWARE_DIST	Active BT-MOB RAT shop, malware-as-a-service
🚰 fragapi.com	CRYPTO_DRAIN	Seed-phrase harvesting form (browser-confirmed)
🚰 instasolana.bond	CRYPTO_DRAIN	Solana wallet drainer, 1,674-domain shared infra
🪙 purnp-fun.com	PHISHING_CRYPTO	Fake Pump.fun / Solflare phishing page
☣ kmspico.zip	MALWARE_DIST	Malware under crack/keygen disguise
💳 rollmaneycontrol.bond	CARDING	Money-mule / fund-transfer fraud

Full per-domain narrative: case/HIGH_SEVERITY.md

---

  Enforcement, repository guide, mirrors and citation

⚖ Enforcement Posture

This report is structured as an evidence package for criminal and financial-intelligence agencies, not as an ICANN compliance filing.

ICANN enforces registrar obligations through the Registrar Accreditation Agreement, including the abuse-response and DNS abuse mitigation requirements in RAA §3.18. In this case, ICANN followed repeated breach notices with termination effective 11 September 2026. We welcome that action; see the enforcement outcome and official sources above. Contractual enforcement and any criminal investigation are separate processes.

Fewmoretaps OÜ collects registration revenue from operators conducting wire fraud, credential theft, carding, and cryptocurrency theft — establishing a knowing position in the criminal money flow. Criminal liability does not require ICANN action as a prerequisite.

Agency	Jurisdictional Basis
🇪🇪 Politsei- ja Piirivalveamet	Primary registration jurisdiction · EU AML Directive
🇪🇪 CERT-EE / RIA	National CERT · cybercrime reporting authority
🇪🇺 Europol EC3	Cross-border cybercrime coordination · iForce referrals
🇺🇸 FBI IC3	Wire fraud (18 U.S.C. §1343), CFAA — US victims
🇺🇸 FinCEN	Money-services business violations · USD flow tracing

---

📂 Repository Structure

trustname-evidence/
├── 📊 docs/                                 GitHub Pages site
│   ├── index.html                          Executive report — metrics, charts, gallery
│   ├── domains.html                        Searchable June 2026 HTTP-scan snapshot (7,641 records)
│   ├── data.json                           Slim dataset for the live report
│   ├── build_datajson.py                   Generator: enriched.csv → data.json
│   ├── sitemap.xml / robots.txt / .nojekyll
│   └── screenshots/                        Local mirror; ignored by git, publish via S3/Git LFS
├── 📁 data/                                 Source datasets
│   ├── enriched.csv                        Full per-domain dataset
│   ├── high_severity.csv                   HIGH-only filtered subset
│   └── dead_domains.csv                    Dead / parked enumeration
├── 🚫 ioc/                                  Indicators of Compromise
│   ├── domains_high.txt                    3,293 HIGH blocklist
│   ├── domains_all_malicious.txt           4,276 HIGH + MEDIUM blocklist
│   └── indicators.csv                      SIEM-ready
├── 🔐 evidence/
│   ├── screenshots/                        Local screenshot archive; ignored by git
│   └── HASHES.txt                          SHA-256 manifest
├── 📄 case/                                 Narrative reports
│   ├── INVESTIGATION.md
│   ├── HIGH_SEVERITY.md
│   └── CLUSTERS.md
├── 📦 pkg/raw_data/                         Compressed raw scan output
│   ├── enriched.csv.gz
│   ├── lambda_results.jsonl.gz
│   ├── deep_results.jsonl.gz
│   └── threat_intel.jsonl.gz
├── 🔧 .github/workflows/pages.yml           Auto-build & deploy
├── 📄 PROVENANCE.md                         Chain of custody
├── 📄 VERIFY.md                             Hash verification and release signing
├── 📄 NOTICE.md                             TLP:CLEAR and evidence-use notice
├── 📄 CITATION.cff                          Citation metadata
├── 🔐 SHA256SUMS.txt                        Repository SHA-256 manifest
├── 📜 LICENSE                               MIT
└── 📖 README.md

---

🌐 PhishDestroy

PhishDestroy is an independent anti-phishing and anti-fraud research project. Our work includes:

• Domain abuse detection at scale — complete-zone scans of accused-bulletproof registrars, real-time IOC feed publication, infrastructure clustering
• Operator attribution — corporate-registry forensics, payment-rail tracing, fake-review forensics, infrastructure mapping
• Public evidence packages — TLP:CLEAR, MIT-licensed, formatted for ICANN compliance, law-enforcement intake, and academic citation

🌐 Main site & research index: phishdestroy.io 📚 Investigation archive: phishdestroy.io/articles 🐙 Code & datasets: github.com/phishdestroy

🌐 Mirrors and Long-Term Access

Channel	Identifier
🐙 GitHub	phishdestroy/trustname-evidence
🌐 GitHub Pages	phishdestroy.github.io/trustname-evidence
📰 PhishDestroy publication	phishdestroy.io/trustname-bulletproof-exposed
🌐 PhishDestroy main site	phishdestroy.io
⏳ Wayback Machine	snapshot pinned on publication

---

📚 Citation

@misc{phishdestroy_trustname_2026,
  author       = {PhishDestroy Research},
  title        = {Fewmoretaps O\"U / Trustname.com --- Registrar Zone Evidence
                  (Phase II of the Trustname Investigation)},
  year         = 2026,
  month        = jun,
  howpublished = {GitHub},
  url          = {https://github.com/phishdestroy/trustname-evidence}
}

Plain text:

PhishDestroy. (2026). Fewmoretaps OÜ / Trustname.com — Registrar Zone Evidence
(Phase II of the Trustname investigation). GitHub.
https://github.com/phishdestroy/trustname-evidence

---

  Legal notice & responsible disclosure

⚖️ Legal Notice & Responsible Disclosure

All data in this repository was collected exclusively from publicly accessible sources:

Source	Method
Zone file	ICANN CZDS — accredited access, permissible use
WHOIS	Public WHOIS protocol (RFC 3912)
HTTP responses	Passive crawl of publicly reachable URLs
DNS records	Passive DNS / authoritative queries
Screenshots	Rendered pages accessible to any browser

No non-public systems were accessed. No credentials were tested. No authentication was bypassed. No victim data was processed.

This publication is conducted under:

• ICANN Registrar Accreditation Agreement §3.18 (abuse response obligations)
• CISA Coordinated Vulnerability Disclosure guidelines
• FIRST.org TLP:CLEAR definition — unlimited public sharing permitted

Regarding Reputational Impact

This research documents objectively verifiable facts: domain registration patterns, HTTP response content, and registrar abuse-response latency. Trustname.com / Fewmoretaps OÜ was an ICANN-accredited registrar during the investigation period. ICANN subsequently terminated its accreditation agreement effective 11 September 2026; the official sources are linked in the enforcement update.

Publication of factual evidence of contractual non-compliance with ICANN's abuse-response requirements is not defamation — it is the function those requirements were designed to enable. Registrars that maintain functional abuse response pipelines have nothing to fear from this disclosure.

If Trustname disputes any finding: submit documented evidence via phishdestroy.io. Findings supported by evidence will be corrected in a timestamped update.

📜 License	MIT — see LICENSE
🏷 TLP	CLEAR — unlimited distribution, no restrictions
🤝 Sharing	Researchers, journalists, law enforcement, brand protection teams — use freely
📋 Evidence notice	NOTICE.md
🔏 Verification	VERIFY.md
🌐 Contact	phishdestroy.io

---

  Related registrars & operator record

🕸️ Network of Complicit Registrars

This investigation is part of a series documenting abuse handling and fraud infrastructure at current and former ICANN-accredited registrars. Trustname's accreditation has since been terminated, as documented in the enforcement update.

#	Registrar	IANA	Zone	Confirmed Malicious	Russian Connection	Investigation
1	NICENIC INTERNATIONAL GROUP	#3765	403,909	82,575 (44.0% of alive)	🇷🇺 #2 hosting country (8.5%)	nicenic-evidence · Live Report
2	Trustname.com / Fewmoretaps OÜ (this)	#4318	18,719 (June 2026 scan)	4,275 (35.4% of alive)	🇷🇺 Russian-operated, Estonian shell	trustname-evidence · Live Report
3	NameSilo, LLC	#1479	5,653,085	122,152 HIGH (3.63%)	🇷🇺 Russian team members, suppression campaign	namesilo-evidence · Live Report

---

🇷🇺 Russian Connection & Complicity Record

The Operators — Belarusian, Not Estonian

Fewmoretaps ÖÜ is registered in Estonia but operated entirely by Belarusian nationals with zero legitimate business activity:

Original Founder (2021–2023):

Field	Detail
Name	Vitali Tsyvinski
Nationality	Belarus
Personal ID	39403090187
Role	Sole board member & shareholder
Signed	2022 annual report on 13.01.2023

Current Owner / CEO (since 23.05.2023):

Field	Detail
Name	Kiryl Nestsiarovich ("Kir N.")
DOB	09.09.1993
Nationality	Belarus
Phone	+375 29 2964411 (MTS mobile, Belarusian carrier)
Shareholding	100%
Status	Listed as CEO on trustname.com/about

Estonia is used exclusively as a jurisdiction of convenience. The company has one employee (Nestsiarovich himself), €120 declared revenue in 2024 against €175,310 in long-term liabilities, and is currently under liquidation.

Financial Reality vs. Marketing Claims

What Trustname.com claims:

• "#1 fastest growing independent registrar in 2025"
• "Trusted by millions"
• Fortune 500 clients: McDonald's, Vodafone, Adidas, Yahoo, BCG
• "Team of over 35 people"
• Offices in London, Beverly Hills, Melbourne
• "Since 1997"

What Estonian tax filings show:

• €120 total revenue (2024)
• 1 employee (Nestsiarovich)
• Incorporated 2021 — not 1997
• Company under liquidation proceedings
• Virtual office address only
• 30 fake website testimonials — only 11 unique first names ("Jack" ×5, "Lily" ×6)

The gap between the marketing front and the corporate reality is not a discrepancy — it is the business model.

Crypto Wallets (Accept Monero — Untraceable)

Asset	Address
ETH	0xdee6582dc53fa56180311393018121c6f1e8bd7c
LTC	MEREvHtzqAUTJ1XvEevmci8UqMnDvfe2ri
ZEC	t1d19KevpcXpesr9XA9UUyMW9XGYVDxkK9S
XMR	8B5N29BocrTjkRCeGCARnkhKgBeHBhg4oH7ay4RfXfnL7RqBdyiuL4k6iN4GVUVxt1EQJvZRqLg8n4qgCNWmYHQQDZmfytM

At the time of the investigation, Trustname accepted Monero (XMR), declared €120 in annual revenue, and held ICANN accreditation. ICANN has since terminated that accreditation agreement on the abuse-handling grounds documented above. Questions about cryptocurrency payments, financial reporting, and compliance with Estonian AML or licensing requirements remain matters for the relevant authorities.

Russian-Language Fraud Infrastructure

Active scam casino domains registered through IANA #4318 in April 2026, all shielded by registrar-owned privacy proxies:

Domain	Registered	Notes
noawin.com	04-12-2026	Privacy: Perfect Privacy LLC (St Kitts & Nevis)
henofex.com	04-09-2026	"Elon Musk" Casino scheme
jopexplay.com	04-10-2026	Cloudflare-blocked
bezowin159.pro	04-13-2026	Privacy: WHOIS Privacy Protection LLC
noswin152.pro	04-08-2026	—
bazowin781.pro	04-08-2026	—

Shared backend: gambler-partners.is — Russian-language admin panel titled "Gambler | Главная"

Trustname operates two registrar-owned privacy proxy services to shield its fraud customers:

• harakiri.org — Perfect Privacy LLC, Saint Kitts & Nevis — accepts BTC, LTC, XMR, ZEC
• whoispps.com — WHOIS Privacy Protection LLC, Orlando FL — "Physical mail is discarded"

Documented Obstruction

• Domains with full evidence packages survive abuse reports without suspension.
• Registration revenue and crypto payments flow from operators running wire fraud, credential theft, and casino scams — knowing position in criminal money flow.
• The original investigation criticized the continued accreditation of a company reported to be under liquidation. Status update: ICANN terminated the accreditation agreement effective 11 September 2026 for repeated abuse-handling failures; we welcome and credit that enforcement action.
• As an EU-registered entity subject to Estonian AML/CFT law and the EU's VASP framework, Fewmoretaps is operating a de facto unlicensed crypto exchange.
• Direct abuse reports with evidence: ignored or met with form-letter non-responses.
• Criminal liability under Estonian law does not require prior ICANN action.

Original investigation commentary, describing the period before termination:

"€120 revenue. €175,310 liabilities. Monero accepted. One employee. ICANN-accredited. Under liquidation. This is not a registrar — it is a fraud infrastructure service with a compliance veneer."

Full Phase I investigation: phishdestroy.io/trustname-bulletproof-exposed

🔗 Related Investigations

PhishDestroy Research · Phase II · June 2026 · TLP:CLEAR