Yes, that email matches a long-running domain registration scam. The copy that reached the generic info mailbox of one of our clients follows the pattern exactly. Do not reply and do not pay. Here is how to check any copy in five minutes with free tools.
Figure 1: The redacted message.
Key takeaways
- The email claims a company applied for your brand as .cn names; DNS returns nothing.
- The 15-month-old sender domain has no website and mails from a United States network.
- Its HTML loads one remote logo image from a fourth domain, inboxcn.com.
- The signature’s contact numbers are reported under at least eleven sender names.
What is a domain registration scam from China?
A domain registration scam from China is a mass-mailed email claiming a company is about to register your brand as Chinese domain names unless you act. According to published warnings, the aim is to frighten you into replying, then sell you registrations at inflated prices.
The subject is just the brand name, example-brand, and the text asks to be forwarded to the CEO. It claims a “China domain name registration center in Shanghai” was asked by Dekang Ltd to register example-brand as an internet keyword and four matching .cn names – dated the day it was sent.
The signature reads “Michael Liu, General Manager, CNNET Registry”, telephone +86-2161918696, fax +86-2161918697, mobile +86-13816428671, address 12F Kaike Building, No. 1801 Hongmei Road, Shanghai 200233, China – sent from michael@cnnetprovider.net via Foxmail, a desktop mail program.
An internet keyword is a private vendor service that redirects a typed keyword to a web address – not a domain name, not part of the DNS rules or any registry or ICANN process. Owning one gives no rights over your brand.
Why does the sender’s name keep changing?
The sender’s name keeps changing because the name is disposable: the same mobile number, and in later reports the same telephone and fax and Shanghai address too, appear under at least eleven sender names over more than a decade. The contact details are the constant.
A business blog recorded the same mobile number under an earlier “China Registry” alias (cdmrev.com); a forum thread collected two more aliases (NamePros); a hosting company published the same telephone and fax under another name (Advantage Hosting); one analysis logged three aliases on three different domains and concluded that “the contact details are the operation” (secure-techie.com). Template warnings go back more than a decade (web-solutions.eu, Security StackExchange).
Is cnnetprovider.net a real registry?
cnnetprovider.net is not a registry. The sending domain was created about 15 months before the email and has no website; the real registry operator for .cn is CNNIC. Nothing in the email shows a registrar accreditation number or a registry licence.
RDAP names the registrar Xin Net Technology Corporation; the registrant is hidden. DNS shows no address record, only mail: mx.cnnetprovider.net resolves to 209.141.48.41 – per ARIN, a United States hosting network, not Shanghai. All four claimed .cn names returned NXDOMAIN: no sign of any applicant.
The logo points to a second domain, cnnetregistry.org.cn, whose website claims a decades-long history. It was registered about three months before our check, though a relaunch is possible. Its contact page repeats the email’s address, telephone and fax, yet the email came from cnnetprovider.net. A real company writes from its own web domain.
The message has no attachment and no clickable link, but the HTML loads one remote logo image from a fourth domain: inboxcn.com/image328.png, registered five days after the sender domain. Three domains – cnnetprovider.net, inboxcn.com and cnnetregistry.org.cn – share one registrar and name servers.
The image URL has no per-recipient code, but loading remote images sends your IP address and opening time to that host – a standard open-tracking effect. Whether this sender tracks opens is unverified; view suspicious email as plain text or disable remote images.
When we opened the image address in a desktop browser, an antivirus product (AVG Web Shield) blocked the request and flagged it with a generic trojan label. The host’s error page loads a script from a third-party domain. We did not analyse that script, so treat the label as a warning, not proof. Never open links or image addresses from a suspicious email in a browser: use the lookups below instead.
Figure 2: The antivirus alert shown when the logo’s host was opened.
SPF is a DNS record listing servers allowed to send mail for a domain (RFC 7208); DKIM is a signature showing which domain’s key signed a message (RFC 6376); DMARC is a policy record telling receivers how to treat failing mail (RFC 7489). This sender publishes SPF, DKIM and a “p=none” DMARC policy and signs its mail with DKIM: that shows it controls its domain, not that it is honest.
How can you check a domain registration scam email yourself?
You can check a domain registration scam email yourself in about five minutes with free public tools: registration records, DNS lookups over HTTPS and IP ownership data. None needs special software. These are the checks we ran on the sender domain.
How to check the sender in five minutes
- Pull the registration record: curl -s https://rdap.verisign.com/net/v1/domain/DOMAIN (use /com/v1/ for .com), or the ICANN lookup tool.
- Check for a website: curl -s “https://dns.google/resolve?name=DOMAIN&type=A”.
- Find the real mail server: read the bottom-most Received: header line, then query curl -s “https://dns.google/resolve?name=DOMAIN&type=MX”.
- Look up the IP owner: curl -s https://rdap.arin.net/registry/ip/IPADDRESS.
- Read the authentication records: curl -s “https://dns.google/resolve?name=DOMAIN&type=TXT”; for DMARC query _dmarc.DOMAIN.
Figure 3: The five-minute sender check.
For our client’s message:
| What the email claims | What we checked | What we found |
|---|---|---|
| Dekang Ltd applied for your brand | DNS for the four .cn names | All NXDOMAIN; no applicant |
| A registration center in Shanghai | The real .cn registry operator | CNNIC; “CNNET Registry” is no registry |
| Sent from a Shanghai office | Owner of mail IP 209.141.48.41 | FranTech Solutions, a United States host |
| A registrar with decades of history | RDAP for cnnetregistry.org.cn | Registered about three months before our check |
| A company logo and website | The image host inboxcn.com | A fourth domain; same registrar and name servers |
| Genuine contact numbers | Public scam reports | Same contact numbers under at least eleven sender names |
What should you do with this email?
Do nothing that costs money: do not reply to this email and do not buy any domain it offers. Mark it as phishing, report it, delete it. If you ever want .cn names, choose them yourself through a registrar you already trust.
Treat it like any phishing attempt: CISA explains how to recognise and report phishing; the UK’s NCSC covers phishing and scam emails. United States: report to the FTC and the FBI’s IC3.
Then fix the process. Public “info” mailboxes attract this mail. Our small business security checklist covers the basics that limit the damage when a scam does get through, including a one-page incident plan. Write the routine down in one shared place: a company knowledge base for small teams.
What we could not check
Some things stay unknown: who runs cnnetprovider.net, inboxcn.com or the logo’s website; whether anyone applied for the four names; whether the sender tracks opens; whether “Michael Liu” is real. The records support one narrower claim: this message matches a long-running scam pattern.
Records in this post were last checked in November 2026.
Frequently asked questions
Is cnnetprovider.net a scam?
We do not know who runs cnnetprovider.net, and we do not call anyone a criminal. Records show a hidden registrant and a United States mail server. The email matches a long-running scam pattern.
Should I reply to say we did not authorise it?
No. A reply confirms a live mailbox and, per public reports, brings a price list for .cn, .hk and .asia domains at inflated prices. Mark it as phishing, then delete it.
Do I need to register .cn domains?
Only if your business genuinely wants a presence in China, never because an email pressured you. Any registrar you trust can register .cn names for you, at your own pace.
What is an internet keyword?
A private vendor service that redirects a typed keyword to a web address – not a domain name, and no protection for your brand. The pressure around it is the red flag.
Where do I report this?
Use official channels: the FTC takes fraud reports, the FBI’s IC3 collects email crime complaints, and CISA explains how to report phishing. In the UK, see the NCSC guidance on phishing.
Any business with a public “info” mailbox will meet a domain registration scam email. Check the records first; never let a stranger’s deadline decide what you buy. The same discipline protects your code: we help technical teams handle the OWASP Top 10 vulnerabilities in their own code, build more secure apps and make security second nature when apps are handed over. Book a free 30-minute review of how your team handles suspicious emails and domain notices via our contact page or write to info (at) abcsoft (dot) digital.
Add a Comment