tldr: XYZ infrastructure is literally collapsing, they couldn't transfer in one of their own domains without a staff override.
- Initial transfer attempt
- Namecheap e-mails me the “transfer Authorization Code”
- Gen.xyz web interface claims “Invalid EPP Code”
- I contact Gen.xyz support
- Gen.xyz staff tells me“Please request a new EPP code from Namecheap”
- I contact Namecheap support via web chat
- “I need a new EPP for my domain, ishygddt.xyz; XYZ support told me to request a new one because the one I was sent was invalid.”
- Namecheap: “For your convenience, I have generated a brand new Auth/EPP code and sent it to you.”
- It, too, yields “Invalid EPP Code”
- Namecheap: “As I've checked, the Auth code is valid.”
- I return to pester Gen.xyz support
- “I'm trying to transfer my domain from Namecheap, but their EPP codes don't seem to work. The latest one they sent me is …”
- XYZ replies “Thank you for reaching out to the Support Team. I have manually created the order.”
- They put a different domain on my account, and invoiced me for it.
- I paid the invoice before noting their mistake 🤦
- “I'm sorry, but on closer inspection, I was given the wrong domain. I'm trying to transfer in ishygddt.xyz (the domain which is in my e-mail address and which I was trying to register in previous screenshots), but the domain that was just put on my account is ishygodt.xyz”
- “Apologies for the typo, I misread. I have created the order for the correct domain.”
- I pay the (legitimate) invoice
- Status: “Pending Transfer”… but also, disturbingly, still in my “Cart” on-site. And opening the cart reminds me that the EPP I've entered is still invalid.
- After several days, it transfers over to GenXYZ!
- I return again to pester Gen.xyz support, to request a refund
- “When resolving support ticket #████, I was wrongly invoiced for this domain. I did not order this domain, and paying this invoice was a mistake on my part. Will you refund this? … ishygodt.xyz, with an "o"; I did not order it; invoice #████ was unsolicited.”
- After a few days, the refund arrives!
I have a creeping suspicion that they might be vulnerable to social-engineering attacks…
