>Has anyone ever seen them do anything like this?
No, I've never seen them do this. But at the same time, I'm not going to give them the opportunity.
Bear in mind, the context here is not domains doing something awful or spamming people or mounting your own attacks. It's "somebody's attacking you, and we think that you suspected they would".
As others said every service reserves the right to do things like this, they just typically phrase differently. To quote GoDaddy:
> You acknowledge and agree that GoDaddy and registry reserve the right to deny, cancel or transfer any registration or transaction, or place any domain name(s) on lock, hold or similar status, as either deems necessary, in the unlimited and sole discretion of either GoDaddy or the registry: .. snip .. (ii) to protect the integrity and stability of, and correct mistakes made by, any domain name registry or registrar,
Emphasis mine and a bit snipped out since this is already long. This says if it affects their stability they can transfer your registration as they see fit. It doesn't include any protections on when you can change the domain or what they can change it to meaning blackholing you into localhost for a year is fine.
>As others said every service reserves the right to do things like this, they just typically phrase differently. To quote GoDaddy:
Suspending a domain is standard practice, sabotaging one by setting long EOLs is not. It is dishonest to suggest that these are similar.
No, this is simply indefensible. There's simply no way you could ever excuse this.
Suspending a customer domain is OK, this is not.