Hacker News Reader

I too have this IP in my account login history. As well as others since July from other places globally.

This appears it was not brute force attempts, as the log would show failed login attempts. They just logged right in, first try. Sounds like a web site vulnerability.

If you are moving domains to a different registrar try Gandi. I have no affiliation with them except as a happy customer.

They also support two-factor authentication and delegation of limited permissions to other Gandi accounts. For example, if I'm doing a website for a client I have them purchase from or transfer the domain to Gandi, then delegate only technical rights to me for administering their DNS.

This all helps with account security, or damage control for when things go wrong.

Check for registrars that offer two-factor authentication. I use this security feature with Namecheap.

Guess I'll check mine later also...