Looks like they used Njalla (https://njal.la) a provider that seems to focus on ...

Looks like they used Njalla (https://njal.la) a provider that seems to focus on "privacy aware" domains and virtual private servers hosted in Sweden.

According to their FAQ, when you register a domain name through them, they own the domain but they respect the agreement between them and the customer to let the customer have "full usage rights".

They seem to provide rather fun named name servers. Reads "you can get no info".

    dig +short ns solarleaks.net | sort
    1-you.njalla.no.
    2-can.njalla.in.
    3-get.njalla.fo.

They accept a bunch* of cryptocurrencies and then PayPal.

[*]: "Bitcoin, Litecoin, Monero, ZCash, DASH, Bitcoin Cash, Ethereum"