I was recently asked to help with an abandoned website. The domain name was registered by a defunct hosting company, yet the website was still running, somehow. I contact the company who apparently took over the hosting, and after two quick emails they changed the IPSTAG for me. Great response, except they didn’t do any kind of identity check, or even ask for the old password. I could have been anyone and they’d have simply handed me the domain! Maybe they were just happy to get rid of it, but still…The domain was originally with E7even, who were taken over by 186k. (post edited so it actually makes sense)