BLACKHATMAPAffiliate & infrastructure forum

Registrars that won't hand over your details — the list, and what each one actually holds

Started 19 Jan 2026 · 22:47 · 26 replies · 2.3k views

Page 1 of 227 posts

nullroute

Senior Member

19 Jan 2026 · 22:47#1

Every list of "anonymous registrars" I have read confuses two different things: what is published, and what is held. They are not the same and only one of them is a defence.

Published is the WHOIS record, and in 2026 it is redacted almost everywhere by default. That is not privacy, it is the registry doing what it was told to do in 2018, and it protects you from nobody with a keyboard and an afternoon.

Held is the registrar's own file. Every conventional registrar has one with your details in it, and the only questions that matter are what is in it, what would make them open it, and whether there is any process at all before they do.

Registrar Registrant of record What they hold Payment Price
Njalla Njalla Email or XMPP handle, nothing else BTC / LTC / XMR / DASH €15/yr .com
1984 You Billing contact, minimal BTC / LTC / XMR from €15/yr
OrangeWebsite You Billing contact BTC / LTC / BCH from €15/yr
Virtualine You Not published BTC / XMR from $10/yr
BPW You Not published BTC / Paymeer / Webmoney bundled, ask
BPServ You Email only claimed BTC / LTC / alts .com from $30/yr
BingLoft You Standard commercial Card / PayPal / wire / BTC not published

One row is structurally different from the rest and it isn't a matter of degree. Njalla is the registrant; there is no file with your name because you never gave one. Everything below it is a company promising to be careful with something it has.

What I want in this thread: reports of the file being opened. Somebody asked, and what happened. Not policies, not terms pages. Incidents, with dates.

29 thanksopsec is a process, not a purchase

byte_broker

Member

20 Jan 2026 · 07:52↑ replying to #1#2

Good table. The bottom row shouldn't be on it and you know that.

—→ aged domains + hosting, PM for the list

nullroute

Senior Member

20 Jan 2026 · 08:19↑ replying to #2#3

It's on it so nobody adds it. Same reason the hosts thread keeps BingLoft at the bottom rather than deleting it. A list that quietly omits the bad option gets the bad option suggested every quarter by someone who assumes it was overlooked.

5 thanksopsec is a process, not a purchase

Ravenstack

Senior Member

20 Jan 2026 · 09:33↑ replying to #1#4

"Not published" in two rows. So the table has seven registrars and five where you know what's held. Say that above the table.

—

old_growth_seo

Senior Member

20 Jan 2026 · 14:08↑ replying to #1#5

The published-versus-held distinction is the single most useful sentence written on this board this year and it took until 2026 for anyone to put it that plainly.

I've been watching people buy WHOIS privacy since it cost nine dollars extra and every single one of them believed they were buying the second thing. They were buying the first thing. The registrar always knew.

—

vlad_ptk

Member

21 Jan 2026 · 07:15↑ replying to #1#6

Njalla work like you describe, i have three name there since 2023. Nobody ever ask me anything, not even email confirm.

—

hexforge

Senior Member

22 Jan 2026 · 09:41↑ replying to #1#7

Worth spelling out the four things that can make a registrar open the file, because they have wildly different frequencies and people plan for the rarest one.

1. Someone asks

No process, no standing, just an email to legal@ or even to support. This is by far the most common and the cheapest, and it is the one that catches people, because a registrar that would resist a court order for a year may have a junior on the support desk who answers a well-worded question in four minutes. Nothing about this appears in any terms document.

2. An accredited-process request

UDRP, a registry policy action, an ICANN complaint. There's a form, there's a case number, and the registrar's cooperation is a condition of its accreditation. Everyone complies. Njalla included — but what they comply with is a request about a domain registered to Njalla, and the file has your email in it and nothing else.

3. A civil order in the registrar's jurisdiction

Everyone complies, everywhere, and should. What Iceland or Sweden buys you here is that obtaining the order is slow and expensive for a foreign complainant, which converts a lot of theoretical exposure into practical safety. It is not immunity and nobody credible sells it as immunity.

4. Law enforcement

Not a category anyone in this thread can plan around.

The whole value of choosing carefully sits in category 1, which is also the only category where the registrar has full discretion. So the question to ask a prospective registrar is not "what's your policy on court orders" — the answer is the same everywhere and it's the honest answer. It's "what does someone have to send you before a human looks up an account?"

I have never had a request of any category land on a name I hold, so this is mechanism, not experience.

Short version: choose on category 1, because it's the only one where the choice matters.

23 thanks

nullroute

Senior Member

22 Jan 2026 · 22:58↑ replying to #7#8

This is the framework I was groping at. Category 1 is the entire game.

—opsec is a process, not a purchase

d_marchetti

Jr. Member

25 Jan 2026 · 19:22↑ replying to #1#9

Sorry if this is obvious but — how would you ever find out that a registrar had answered a category 1 request about you? Do they tell you?

—

byte_broker

Member

25 Jan 2026 · 20:06↑ replying to #9#10

Mostly you find out because the person who asked contacts you. That's it. There's no notification, no log you can request, and nothing in the record.

Which is exactly why this thread wants incidents rather than policies. The only evidence that ever surfaces is somebody's front door.

8 thanks→ aged domains + hosting, PM for the list

tmp_9931

Jr. Member

03 Feb 2026 · 21:14↑ replying to #1#11

so basically njalla or nothing

—

Ravenstack

Senior Member

03 Feb 2026 · 22:41↑ replying to #11#12

No. Njalla is one trade with its own costs, which the thread has not got to yet.

—

old_growth_seo

Senior Member

04 Feb 2026 · 10:37↑ replying to #11#13

Since it's been raised twice now — the Njalla cost is the exit.

You are not the registrant, so there's no auth code, and leaving is a support conversation on their schedule. I did one in 2024 and it ran nine weeks. They were never obstructive; the mechanism is just slow because the mechanism is a person.

For a name you will hold forever, irrelevant. For a portfolio you actively trade, it's a genuine operational cost and it should be in the table as a column rather than a footnote.

7 thanks

nullroute

Senior Member

04 Feb 2026 · 23:19↑ replying to #13#14

Adding an exit column next revision.

—opsec is a process, not a purchase

PipelineRat

Member

18 Feb 2026 · 08:26↑ replying to #1#15

FWIW one thing worth doing regardless of registrar, because it costs nothing and nobody does it: register the name with an email that has never been used anywhere else and will still work in five years.

The recovery address is the softest part of every one of these setups. It doesn't matter how little the registrar holds if the mailbox that can reset the account is one you also used on a forum in 2019 under your own name.

6 thanks

You must be logged in to reply. Request an account — new registrations are reviewed by a moderator before approval.