This documentation serves as a comprehensive record of the unresolved dispute regarding the unauthorized loss of malaysia.build. From the initial complaint filed on Jun 11, 2025, through the transition to Namecheap’s Legal department on Jul 15, 2025, and up until the current date of Jun 6, 2026, Namecheap has maintained a posture of strategic silence and premature closure.
Throughout 24 major formal correspondences, I have raised critical questions regarding security protocols, registrar responsibility, and financial accountability. Despite the high stakes in documented development losses—the vast majority of these demands remain entirely unanswered.
The “Selective Transparency” Strategy
Out of dozens of core demands for explanation, Namecheap has provided only two significant admissions, both of which confirm a catastrophic failure of their own systems:
-
Security Failure: Namecheap explicitly admitted on Jul 14, 2025: “According to our logs, the EPP code was not requested.” This confirms the domain was transferred out without the mandatory security authorization required by ICANN.
-
Status Confirmation: On Jun 21, 2025, they confirmed the domain had been moved to a “reserved” status, yet they have failed to explain why this occurred 5 months before the paid expiry date.
The Unanswered Challenges
Beyond these two admissions, Namecheap has entered a state of “Procedural Abdication.” The following critical questions have been repeatedly requested but remain met with total silence:
-
The EPP Security Breach (Repeatedly Challenged): I have asked Namecheap at least six separate times (Jul 12, 13, and 14) to explain how a transfer is even technically possible without an EPP request. If no code was requested, it implies either a massive internal security bypass or an unauthorized manual override. Namecheap has refused to provide the IP logs, timestamps, or authorization proof for this “code-less” transfer.
-
Action & Timeline: What concrete actions are being taken with the .BUILD registry, and why is there no defined resolution timeline after 359 days?
-
Contractual Responsibility: Under ICANN RAA Section 3.3.3, Namecheap is the Registrar of Record. Why does Namecheap continue to defer responsibility to “upstream providers” and “registries” while refusing to provide a case ID or escalation proof?
-
Financial Liability: Does Namecheap accept responsibility for the foreseeable financial harm they admitted to on Jul 13? If restoration is impossible, what is the compensation framework for the total loss of a 30-month project?
-
Due Process: Why was the domain removed without any prior notice of violation or opportunity for the registrant to respond?
The following timeline details the exhaustive effort to seek clarity and the subsequent “wall of silence” built by Namecheap to avoid accountability during their ongoing $1.5B ownership transition.
To: Namecheap Domains Support Team
-
Escalated after 3 weeks.
-
-
What actions are being taken with .BUILD registry?
-
When is resolution expected?
-
Will compensation be offered?
-
Full disclosure of the .BUILD registry’s contact information
-
The specific policy or regulation that prohibits use of “malaysia.build”
-
Why no prior violation notice?
-
To: Multiple Namecheap departments
-
Detailed history, evidence, and financial losses.
-
-
Who is responsible?
-
Will Namecheap compensate?
-
Demanded resolution in 48 hours.
-
To: Multiple recipients including Namecheap
-
Final 48-hour ultimatum.
-
-
Restore build to my Namecheap account.
-
Provide written clarification: Circumstances of transfer (Namecheap) & Basis for reservation (.BUILD Registry)
-
Initiate dialogue on incurred losses.
-
To: Multiple recipients
-
Repeated demand for answers.
- Core Demands for Explanation:
-
A detailed explanation of how the domain was transferred while it was active, paid, and set to auto-renew;
-
A defined action plan to resolve the situation;
-
Any substantial update from your upstream provider or the .BUILD Registry
-
The reason for the transfer of the domain without my authorization
-
The current status and any steps being taken, and
-
A timeline for restoring malaysia.build to my account
-
To: Multiple recipients
-
Asked for direct contact with upstream provider.
-
-
Who will cover financial losses?
-
What if registry remains unresponsive?
-
To: Multiple recipients
-
Listed specific unanswered questions.
-
-
How was domain transferred without EPP?
-
Has registry communicated?
-
What if they remain silent?
-
Who is financially responsible?
-
To: Multiple recipients
-
Cited AI analysis on registrar responsibility.
-
-
Can Namecheap defer responsibility?
-
Who authorized transfer?
-
Has case been escalated to ICANN?
-
Why no timeline?
-
To: Multiple recipients
-
Day 35 follow-up.
-
-
Who authorized transfer?
-
ICANN policy allowing deferral?
-
Why can’t transfer be reversed?
-
Escalation case ID?
-
Internal process?
-
To: Multiple recipients
-
Requested internal logs and verification.
-
-
Who requested EPP code?
-
What verification was done?
-
Why no proactive notice?
-
Can escalation to registry be confirmed?
-
To: Multiple recipients
-
Asked about financial responsibility.
-
-
Will Namecheap cover losses?
-
Under what conditions would they accept responsibility?
-
To: Multiple recipients
-
Follow-up on responsibility.
-
-
Does Namecheap accept financial liability?
-
What steps taken internally?
-
Why no prior notice?
-
To: Multiple recipients
-
Listed still-unanswered questions.
-
-
Namecheap’s position on financial responsibility?
-
Who initiated transfer?
-
Why no EPP?
-
What ICANN policy allows deferral?
-
Escalation case number?
-
To: Multiple recipients
-
Urgent clarification requested.
-
-
What happened to domain?
-
Was EPP used?
-
What actions taken?
-
Will Namecheap escalate to ICANN?
-
Will Namecheap accept full financial responsibility?
-
To: Multiple recipients
-
Refuted Namecheap’s denial of responsibility.
-
-
Does Namecheap accept responsibility?
-
Will they cover losses?
-
When will they escalate to ICANN?
-
To: Multiple recipients
-
Formal request for accountability.
-
-
Will Namecheap accept financial responsibility?
-
If not, will they deny it formally?
-
To: Multiple recipients
-
Final request before public disclosure.
-
-
Will Namecheap accept full financial responsibility?
-
What specific actions taken?
-
Timeline for registry response?
-
Next steps if no response?
-
To: Namecheap
-
Formal follow-up on compensation.
-
-
Who will pay for losses?
-
Does Namecheap accept responsibility?
-
What immediate steps for restoration?
-
To: Namecheap
-
Reiterated unanswered questions.
-
-
Who pays for losses?
-
Does Namecheap accept responsibility?
-
Will they compensate?
-
Steps for restoration?
-
To: Namecheap, cc: ICANN
-
Rejected Namecheap’s denial.
-
-
Safeguard the domain on my behalf while it remained valid.
-
Inform me of any risk, suspension, or potential deletion.
-
Ensure I retained control unless a proper, authorized process was followed
-
To: Namecheap, cc: ICANN
-
Continued demand for accountability.
-
-
Does Namecheap accept financial liability?
-
What steps taken to prevent removal?
-
Why no prior notification?
-
What was payment for if domain not safeguarded?
-
To: Namecheap, Enom, .BUILD registry
-
Final 24-hour notice.
-
- Implied: Will any party take responsibility before public disclosure?
To: Namecheap Legal
-
Formal demand refuting denial.
-
-
Does Namecheap accept responsibility?
-
Will they provide compensation?
-
Plan for restoration?
-
To: Namecheap Legal
-
Repeated demand with analogy.
-
-
Does Namecheap accept responsibility?
-
Will they compensate?
-
Plan for restoration?
-
To: Namecheap Legal, cc: ICANN
-
Formal demand for explanation.
-
-
Did Namecheap contact Enom/registry?
-
What steps to notify registrant?
-
Why was complaint closed?
-
What is Namecheap’s responsibility?
-
How justify profiting while failing to safeguard?
-
Conclusion: The High Cost of Strategic Silence
The evidence presented in this catalogue documents more than just a technical glitch; it reveals a fundamental collapse of registrar accountability. As of 359, Namecheap has moved beyond a simple failure to protect an asset and into a territory of ACTIVE BAD FAITH by choosing to ignore the very security breaches they admitted to in writing.
By their own admission, Namecheap allowed the transfer of malaysia.build—a domain fully paid for and set to auto-renew—without the issuance or request of an EPP authorization code. This is not a “registry-level action” that Namecheap can walk away from; it is a breach of the ICANN Registrar Accreditation Agreement (Section 3.3.3), which mandates that the registrar of record remains fully responsible for the security and management of the domain, regardless of upstream subcontractors.
The “Wall of Silence” Namecheap has maintained since Jul 15, 2025 functions as a tacit admission of unresolved liability. Despite repeated, high-stakes requests for clarification regarding the missing EPP authorization code, the absence of prior registrant notification, and the framework for compensation, no substantive response or remediation has been provided. This prolonged non-engagement has persisted throughout Namecheap’s publicly reported $1.5 billion ownership transition, notwithstanding documented escalation by a 15-year “whale” customer.
The record is now clear:
-
Security was bypassed: No EPP code was used.
-
Harm was foreseen: Namecheap admitted in writing that this would cause financial loss.
-
Accountability was abandoned: Namecheap closed the case without resolution or a path to restoration.
This campaign is no longer just about one domain. It is a warning to every high-value investor and the new owners at CVC: If a registrar can lose a million-dollar asset without a security code and with zero solution for 359 days, no portfolio in their system is truly safe. The floor remains open for a factual response from Namecheap Legal. Until then, the evidence speaks for itself, and the regulatory filings with the Federal Trade Commission (FTC), Arizona Attorney General (AAG), and econsumer.gov will continue to track this systemic failure of governance.
The evidence is cataloged here. The structural solution is THE WONG CLAUSE, and it is being institutionalized.
Disclaimer: This website reflects the author’s personal account and opinions regarding the loss of access to the domain *malaysia.build*. The information presented is based on direct experience, contemporaneous records, and a good-faith belief in its accuracy at the time of publication. Mentions of companies, registrars, registries, or other organizations are included only to factually describe events and circumstances relevant to this case. These references are provided solely to factually describe documented events and communications. They should not be read as allegations of misconduct, negligence, or liability of any individual, company, or organization. The content is provided solely for informational and documentary purposes. It does not constitute legal, financial, or professional advice, and should not be relied upon as a definitive statement of fact or legal conclusion.
Corrections Policy: If any party believes that information contained on this website is inaccurate, incomplete, or misleading, they are invited to contact the author at [email protected]. All requests will be reviewed promptly and in good faith. Verified corrections, clarifications, or updates will be published transparently.
Right of Reply: Any registrar, registry, upstream provider, or organization referenced in this website is welcome to submit a written response. Such responses will be published in full, unedited, to ensure fairness and balance.
© 2025 WONG TAI CHIEW. All Rights Reserved.