@Marina Savina @Spaceship
Hello. I just received this email:
Show attachment 284503
Show attachment 284504
I hold over 18,000 liquid 4-letter .COM domains at Spaceship, all listed in your marketplace. You earn commission on these sales, and buyers may stay with you for renewals and add-ons. The inbound traffic to these parked domains also benefits your brand both directly and indirectly.
Twice since April 2025, you have locked my entire account "for anti-fraud" unless I complete identity verification through a third-party site, magic.veriff.me. I made it clear the first time that I am not willing to upload scans of my government ID to a vendor I did not choose. (The first time it was the same nonsense. I topped up my own account using USDC, received the funds in my account, and right after that I got a block with suspicion of fraudulent activity. When I asked support to explain what exactly was fraudulent in the chain where I funded my account with my own money, I just got a generic reply, and then the block was lifted.) But this time you have completely crossed all reasonable boundaries.
What concerns me is that this verification is aimed at the wrong party. When a marketplace transaction looks risky, it makes sense to verify the buyer and their payment method - not the existing domain owner who did not initiate the payment and is using your own marketplace for transactions. This blanket lock is highly disruptive. It interferes with ongoing sales - the same sales that generate revenue for you. And I have heard many times claims like "the highest data-protection standards", "we never sell or share data", and other similar boilerplate. I have seen such statements from very large companies, only to later witness breaches or deliberate data monetization revealed.
As a matter of principle, I never give scans of my documents to anyone, and never will, except where it is absolutely unavoidable by law and strictly necessary. That is exactly what I strongly advise others to do as well. You are not a bank or law enforcement to demand such sensitive documents, and if your vendor or you were to disappear tomorrow, my personal data could end up exposed on the internet indefinitely.
To be clear: if this cannot be resolved in a privacy-respecting way (for example, as I suggested to your support team back in April after the first restriction: top up my Spaceship balance via bank transfer or card payment, where my full legal name appears clearly on the sender/payer record. That should be more than enough to confirm that the name on my account matches my identity), I will have no issue transferring these domains to another registrar and selling them on other platforms.
I am sharing this so others can understand what kind of surprises they might face with Spaceship under the current policy, in a situation where they sell their domains on Spaceship platform and, in order to receive the money, have to waste time proving something.
To clarify for readers all the context and why this situation surprised me: I did not expect this kind of behavior from a subsidiary of a major registrar like Namecheap. I currently have a balance of $20,180.36 with Spaceship. These funds came from selling domains in
their own marketplace, and I've already used part of the proceeds to transfer new domains to Spaceship and renew existing ones.
Over the last 30 days, I sold 17 domains on the Spaceship marketplace (out of 18,123 that are listed for sale in their marketplace and are in my account) for a total of $20,483. Spaceship's commission is 5%, i.e., $20,483 × 5% = $1,024.15. They
successfully deducted this fee (their revenue), and the remaining amount was credited to my balance. For each sale I received an email
confirming the payment verification procedure.
After another sale in
their own marketplace, Spaceship send me email - quote "to
protect you from any potential fraud" and restricted my account, including my entire balance of $20,180.36. In the name of "protecting" me, they did the following:
1) Did not credit the proceeds from the allegedly suspicious sale.
2) Blocked my access to the funds that were already on my balance from previous verified sales - the same funds for which Spaceship has already taken its commission and previously raised no concerns.
Apparently, I'm expected to submit scans of my ID documents to a third-party verification provider registered in Estonia - a jurisdiction that has been linked to multiple high-profile scandals and the misuse of shell companies. The email link directs me to complete verification on a .me subdomain (e.g., magic.veriff.me) - which is supposedly meant to reassure me that this is a well-regulated, "Swiss-watch-reliable" business. I even checked their privacy notice, which states:
"9.2 However, please note that electronic transmission or storage of information is not always 100% secure. Therefore, despite the security measures that we have put in place to protect Personal Data about you,
we cannot guarantee that loss, misuse, or alteration of data will never occur."
Source:
https://www.veriff.com/privacy-notice
Given that, the notion that I only become "protected" once I hand over my ID scans to a 3rd party vendor I don't trust - one that explicitly admits it can't guarantee data security - is, frankly, absurd. It's so illogical that I can't help but laugh as I write this message.
I could understand temporary limits on transferring new domains into Spaceship if they suspect something. But restricting access to my existing, verified balance - after taking their fee - makes no sense to me. This mirrors the behavior of some crypto exchanges and payment systems: they gladly accept users deposits and profits, but when a withdrawal is requested, they suddenly demand invasive verification and endless explanations.
But in my case, I wasn't even trying to withdraw the money. I planned to use it for renewals in the 2026 calendar year, which for me is the most efficient and fully legal way to minimize taxes.
This experience has seriously undermined my trust. As it stands, I'm no longer considering transferring any valuable domains - 3L, CVCV, and 3k+ other premium 4L names - to this registrar. I'd rather pay more for renewals elsewhere and be confident my assets are safe than risk receiving another "surprise" notice like this.
If this were the first time my account was restricted for dubious reasons, I might chalk it up to a one off mistake. But this is the second restriction in 5 months. And just like the first, it will likely end with no clear explanation of what, exactly, constituted "potential fraud" or where it supposedly occurred. The result is the same, though: the trust is gone, and the bad taste from these actions will stay with me forever.
