phishdestroy/trustname-evidence

<div align="center"> <img src="https://raw.githubusercontent.com/phishdestroy/trustname-evidence/main/docs/assets/banner.gif" width="100%"/> </div>

<div align="center">

<br/>

Trustname.com / Fewmoretaps OÜ

Registrar Zone Evidence — Phase II

<br/>

   

<br/>

 

<br/>

</div>

---

<a name="-enforcement-outcome--credit-to-icann"></a>

⚖️ “Bulletproof” Has an Expiry Date

_{TRUSTNAME · IANA #4318 · ACCREDITATION TERMINATED · Verified 26 October 2026}

Trustname described itself as a “bulletproof domain registrar.” On 11 September 2026, its ICANN accreditation ended. The official IANA record now gives the outcome in a single word: Terminated.

| 10 JUN 2026 | 27 AUG 2026 | 11 SEP 2026 | |:---:|:---:|:---:| | First formal breach notice | Termination notice | Accreditation ended |

NiceNIC, the precedent is now on the record.

<details> <summary><strong>ICANN enforcement · full statement and official sources</strong></summary>

We have been blunt with ICANN when enforcement falls short. Fairness demands that we be just as clear when it delivers. In the Trustname case, ICANN Contractual Compliance deserves credit for both the decision and the pace.

Seventy-eight days from the first formal breach notice to the termination notice. Fifteen more days for the decision to take effect. The fourth breach notice was followed by the decision to terminate the very next day. That is a pace of formal enforcement worth acknowledging.

ICANN gave Trustname opportunities to put its abuse handling right. It examined the responses, documented recurring failures, and brought the accreditation agreement to an end. The decision makes the stakes plain: a registrar that repeatedly fails to investigate abuse reports and act against DNS abuse can lose its place in the accredited system.

For the people documenting phishing, reporting it, and waiting for someone to act, that consequence matters. It also gives responsible registrars a reason to believe that the obligations they meet will be enforced across the industry.

Thank you to the ICANN team that saw this through. The work deserves recognition, and the precedent deserves to be followed.

That brings us to [NiceNIC](https://github.com/phishdestroy/nicenic-evidence). Our complaint and supporting evidence are public. They deserve the same scrutiny, the same urgency, and the same willingness to impose consequences if repeated breaches are established. We will keep asking for that standard to be applied.

<details> <summary><b>Read the official enforcement record</b> · Notices, grounds and dates</summary>

| Date | Primary source | |---|---| | 10 June 2026 | First Notice of Breach | | 26 June 2026 | Second Notice of Breach | | 16 July 2026 | Third Notice of Breach | | 26 August 2026 | Fourth Notice of Breach | | 27 August 2026 | Notice of Termination | | 11 September 2026 | Effective date specified in the termination notice |

The termination notice records four Notices of Breach over 78 days, citing failures under RAA §3.18.1 to investigate and respond appropriately to abuse reports and §3.18.2 to take prompt, appropriate action against DNS abuse. Termination followed under §§5.5.4 and 5.5.6. The intervals highlighted above measure the formal breach-to-termination stage; the notice also documents earlier compliance engagement.

For phishing responders, the notice contains a particularly useful finding: Trustname acknowledged that it had improperly demanded proof that credentials had actually been collected or transmitted, instead of assessing whether the available evidence, taken together, reasonably supported a phishing determination.

The notice also provides for transferring the registrar's domains to a qualified ICANN-accredited registrar to protect registrants. All five notices are listed in the ICANN enforcement index.

</details>

_{The June 2026 investigation below predates termination. Its live feed tracks the research dataset; it does not establish current accreditation or current registrar sponsorship for every tracked domain.}

</details>

---

<!-- LIVE_STATS:START -->

🔴 LIVE INVESTIGATION FEED &middot; Auto-updated &middot; Last fetch 2026-10-26

<table align="center"> <tr> <td align="center"><b>📦 Domains tracked</b><br/><strong>20,038</strong></td> <td align="center"><b>💰 Est. annual value</b><br/><strong>$167,945</strong></td> </tr> <tr> <td align="center"><b>📡 Deployed</b><br/><strong>51.8%</strong></td> <td align="center"><b>✅ IOC classified</b><br/><strong>4,276</strong> (3,293 HIGH)</td> </tr> <tr> <td align="center"><b>⚡ Registered ≤7d</b><br/><strong>0.0%</strong></td> <td align="center"><b>🕵️ Serial regs</b><br/><strong>1</strong></td> </tr> </table>

<details> <summary><strong>Live analytics · TLDs, hosting, registrations and downloads</strong></summary>

🏷️ Top TLD Zones

| TLD | Count | Avg reg→expiry | Est. annual value | |:--|--:|--:|--:| | .com | 14,417 | 398d | $129,609 | | .net | 1,063 | 431d | $10,619 | | .icu | 962 | 365d | $952 | | .org | 903 | 416d | $9,021 | | .latino | 322 | 365d | $1,607 | | .pro | 266 | 378d | $2,125 | | .live | 226 | 384d | $2,258 | | .cyou | 192 | 365d | $190 | | .cam | 176 | 365d | $878 | | .cfd | 156 | 365d | $778 |

🌍 Top Hosting Countries

US  ██████████████████        795 (40.5%)
DE  ████░░░░░░░░░░░░░░        214 (10.9%)
AE  ███░░░░░░░░░░░░░░░        152 (7.7%)
NL  ███░░░░░░░░░░░░░░░        147 (7.5%)
RU  ███░░░░░░░░░░░░░░░        133 (6.8%)
FR  ██░░░░░░░░░░░░░░░░         97 (4.9%)
MD  ██░░░░░░░░░░░░░░░░         95 (4.8%)
GB  █░░░░░░░░░░░░░░░░░         50 (2.5%)

📈 Registration Burst Days

| Date | Domains | × Average | |:--|--:|--:| | 2026-07-13 | 293 | 8.1× 🚨 | | 2026-06-12 | 271 | 7.5× 🚨 | | 2026-06-15 | 227 | 6.3× 🚨 | | 2026-06-25 | 217 | 6.0× 🚨 | | 2026-07-22 | 217 | 6.0× 🚨 |

🎯 Top Targeted Brands & Keywords

trust (106) &middot; swap (72) &middot; login (71) &middot; secure (65) &middot; wallet (60) &middot; support (49) &middot; crypto (45) &middot; binance (43) &middot; account (41) &middot; official (41) &middot; connect (41) &middot; verify (40) &middot; ledger (36) &middot; vault (33) &middot; bridge (33)

🕵️ Top Serial Registrants — 3 emails with ≥5 domains

| # | Registrant Email (redacted) | Domains | |--:|:--|--:| | 1 | wha***@gmail.com | 40 | | 2 | sup***@bro-cas.net | 6 | | 3 | sup***@mypromise.com | 6 |

📥 Download Threat Intelligence

| File | Format | Description | |:--|:--:|:--| | `data/all.txt` | TXT | All tracked domains | | `data/index.json` | JSON | Full analytics snapshot | | `data/ioc/serial_registrants.json` | JSON | Repeat registrants + their domains | | `data/ioc/shared_ips.json` | JSON | Shared hosting clusters | | `data/ioc/brand_domains.json` | JSON | Domains by targeted brand | | `data/ioc/stix-bundle.json` | STIX 2.1 | MISP/OpenCTI bundle (HIGH IOC domains, up to 10k) | | `data/ioc/serial_emails.txt` | TXT | grep-friendly: email⇥count | | `data/ioc/shared_ips.txt` | TXT | grep-friendly: ip⇥count⇥country |

📊 Live web dashboard: see Pages link at top · Updated daily 02:00 UTC

</details>

<!-- LIVE_STATS:END -->

---

<details> <summary><strong>Navigation · all investigation sections</strong></summary>

📑 Table of Contents

<table> <tr> <td valign="top">

Investigation

• “Bulletproof” Has an Expiry Date — ICANN enforcement
• 1 · Background
• 2 · Subject
• 3 · Scope and Coverage
• 4 · Methodology

</td> <td valign="top">

Evidence

• 5 · Headline Findings
• 6 · Operator Clusters
• 7 · Evidence Archive
• 8 · Notable Confirmed Cases

</td> <td valign="top">

Legal / Reuse

• 9 · Enforcement Posture
• 10 · Repository Structure
• 11 · Mirrors
• 12 · Citation & License

</td> </tr> </table>

---

<img src="https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif" width="100%">

</details>

<details> <summary><strong>Investigation · background, subject, scope and methodology</strong></summary>

1 · Background

This repository is the Phase II evidence package of the PhishDestroy investigation into Trustname.com / Fewmoretaps OÜ (IANA registrar ID #4318).

Phase I — operator profile and corporate forensics is published as a standalone article on the PhishDestroy site:

📰 phishdestroy.io/trustname-bulletproof-exposed

This README does not duplicate Phase I material. Refer to the Phase I article for entity, officer, financial, and infrastructure findings.

Phase II — this repository — quantifies the abuse footprint by enumerating every domain in the registrar's zone. Rather than sampling, every domain is processed through a four-stage technical pipeline:

       ╭────────────────────╮      ╭────────────────────╮      ╭────────────────────╮      ╭────────────────────╮
       │   1. AWS Lambda    │ ───▶ │  2. Headless       │ ───▶ │  3. CF Deep Scan   │ ───▶ │  4. AI            │
       │   HTTP fingerprint │      │     B