[kalleboo]

My guess is his domain name contained a phrase that triggers US sanctions alarms. Things like "NICO" etc (don't put that in the reason for a bank transfer or it will get blocked)

[Ms-J]

The phrase shouldn't have triggered sanction alarms as the words in the domain are common and no acronyms. Although anything is possible.