Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I received an email to the email address listed on our website (it's a generic info@ourcompany.com to help "weed out" spam, whereas each employee has something like andreas@ourcompany.com to which I manually forward any "real" email that comes in through the website.)

I received the following email (with actual names replaced with placeholders):

Dear Sir,

We are the department of Asian Domain Registration Service in China. I have something to confirm with you. We formally received an application on April 14, 2014 that a company which self-styled "Some Other Corp. Ltd.". were applying to register some "ourcompany" Asian countries top-level domain names.

Now we are handling this registration, and after our initial checking, we found the name were similar to your company's, so we need to check with you whether your company has authorized that company to register these names. If you authorized this, we will finish the registration at once. If you did not authorize, please let us know within 7 workdays, so that we will handle this issue better.

Best Regards,
Some Fake Person

The email is "plain" (no attachments, no embedded images, just some basic HTML), the email address is "normal" and not consisting of random characters.

Is this a common email scam; and if so, what is their motive?

share|improve this question
    
possible duplicate of A "new domain registration" spam? –  Xander Apr 21 '14 at 21:22
3  
@Xander no, this is something different. –  tylerl Apr 21 '14 at 21:31
    
@tylerl Ok, I've seen similar emails that are essentially just a variation on the theme from the other question. I see from your answer you've had experience with these folks before, and this is different. Rescinding my close vote. –  Xander Apr 21 '14 at 21:39
4  
@Xander This one is a "someone is registering this domain in China, let us know if you think we should reject the application." The linked one is "you registered this domain, give us money to help you protect it." –  tylerl Apr 21 '14 at 21:40
    
I added a link to my answer. There is simply no such "Asian Domain Registration Service in China" –  Matthew Peters Apr 21 '14 at 22:48

5 Answers 5

up vote 28 down vote accepted

Yes, this email is a scam. Ignore it!

I work at a major web hosting firm, and our customers receive these emails on a frequent basis. There are a number of characteristics that are visible from this perspective which confirm that they are a scam:

  1. The emails are never sent by a recognizable, reputable domain registrar. Most of them use generic names, such as "Asian Domain Registration Service" in your email, "China domain registration center", or the like. The emails never have senders, headers, or signatures which explicitly link them with a registrar, and there is usually not even any accredited registrar with the right name.

  2. The domain registrations are never being made by a recognizable company or organization. You've obscured the relevant name as "Some Other Corp, Ltd" here, but the names are often generic ("Foo Trading Co") or incomprehensible ("FANGSHI Co"). Attempts to identify or contact them are never successful (or find only unrelated companies).

  3. They are frequently sent in relation to a domain name which would be meaningless under an Asian top-level domain. Many of them involve domain names containing names of people or locations — for example, these types of emails might claim that a Chinese trading company is attempting to register the domain "johndoe-hardware.hk" or "newyork-blahblah.asia". There is no apparent logic to these registrations.

  4. Despite supposedly coming from many different registrars, these emails always follow a very similar format. There are multiple templates, so the wording can vary, but the formula is always precisely the same. In particular, the domain names being registered are ALWAYS only under "Asian" TLDs (typically .asia, .cn, .hk, .tw, and .in), never under any other TLDs. Additionally, many of these emails also claim that the bundle includes an "Internet keyword" or "Internet trademark", which doesn't even exist.

We have advised a very large number of our customers to disregard these emails, and not once has any of the domains mentioned actually been purchased by the individual or company that was supposedly attempting to acquire them. None of the people who have written about receiving these emails online has had this outcome, either. Everything points to these emails being a widespread scam!


Further reading:

I can only post two links, but you'll find a bunch more if you do a Google search for "Chinese domain scam" or something of the sort. It's widely attested.

share|improve this answer

Yes, this email is a scam. I have received several in the past, and once I played along with them for amusement.

I expressed interest in registering the domain names that were 'under dispute', and they sent me a pricelist for various .cn, .tw, .hk, and .in domains, ranging from USD $40 to $80 per year. They also offered me 'trademark protection' for USD $180/year.

I then told them I'd register the 'trademark protection' and they sent me a form, which stated:

The brand name will be protected by the law around the world after finish the registration.

This statement in particular indicates a scam, because it is extremely unlikely that a trademark could be protected in every country for $180/year!

In addition, the domain names that had been 'applied for' by the 'competitor' have not been registered after 3.5 years, although they were apparently going to be approved unconditionally after 10 workdays.

Apart from their basic English skills they appeared very professional, with a proper logo, a website explaining what they do, phone and fax numbers, and addresses. They even attempted to call me several times.

share|improve this answer

Unlike other variations that I've seen, the following email comes from an address that appears legitimate, as the domain corresponds to a website matching the claims made in the message. Unsure whether this was phishing for financial info or some elaborate "marketing" effort, I decided to respond and see what came next. Here's the exchange:

(Please forward this to your CEO, because this is urgent. Thanks)

We are a Network Service Company which is the domain name registration center in Shanghai, China. On Dec 29, 2014, we received an application from Huabao Ltd requested "gocreativearts" as their internet keyword and China (CN) domain names. But after checking it, we find this name conflict with your company name or trademark. In order to deal with this matter better, it's necessary to send email to you and confirm whether this company is your distributor or business partner in China?

Kind regards Henry Liu General Manager China Registry (Headquarters) 3002, Nanhai Building, No. 854 Nandan Road, Xuhui District, Shanghai 200030, China Tel: +86 21 6191 8696 Mobile: +86 138 1642 8671 Fax: +86 21 6191 8697 Web: www.chinaregistry.org.cn

The URL links to a Chinese site which, on its face, appears to be a real registrar. The email address for "Henry Liu" also uses this domain.

My "response":

Thank you kindly for bringing this to my attention.

Huabao Ltd is not related to Go Creative Arts LLC in any way, and are therefore not entitled to use our trademark. If they are representing themselves as an affiliate or subsidiary, or any other entity with business dealings with our U.S.-based company Go Creative Arts LLC, please let me know and I will refer the matter to my legal counsel.

Best regards,

Dwight Odelius Founder/Principal

Just baiting them here by responding. Note that I do not indicate any interest in contesting the domain -- just a concern that a Chinese company might be pretending to be mine.

The surprise was this email from the company that supposedly wanted the Chinese version of my domain name:

To whom it concerns, We will register the "gocreativearts" as internet keyword and China domain names .cn, .com.cn, .net.cn, .org.cn and have submitted our application. We are waiting for Mr. Henry Liu's approval and think these CN domains and internet keyword are very important for our business. Even though Mr. Henry Liu advises us to change another name, we will persist in this name. Best regards Gareth Cui

A few days later, this follow-up from "Henry Liu":

Dear Dwight Odelius,

Based on your company having no affiliation with them, we have suggested they should choose another name to avoid this conflict but they insist on this name as China domain names (.cn/.com.cn/.net.cn/.org.cn) and internet keyword. In our opinion, maybe they do the similar business as your company and register it to promote his company.

According to the domain name registration principle: The domain name and internet keyword which applied based on the international principle are opened to companies as well as individuals. Any companies or individuals have rights to register any domain name and internet keyword which are unregistered. Because your company haven't registered this name as China domains and internet keyword on the internet, anyone can obtain them by registration. However, in order to avoid this conflict, the trademark or original name owner has priority in the registration of China domain name and internet keyword during our audit period. If your company is the original owner of this name and want to register these China domain names (.cn/.com.cn/.net.cn/.org.cn) and internet keyword to prevent anybody from using them, please inform us. We can send you an application form with price list to help your company register these China domains and internet keyword during our audit period.

Kind regards

Henry Liu General Manager China Registry (Headquarters) 3002, Nanhai Building, No. 854 Nandan Road, Xuhui District, Shanghai 200030, China Tel: +86 21 6191 8696 Mobile: +86 138 1642 8671 Fax: +86 21 6191 8697 Web: www.chinaregistry.org.cn

We have no intention of baiting them further (although I'd really like to find out what this application form and price list look like), but if I receive additional communications I'll post them here in the comments.

For the record, there's no requirement that a registrar validate ownership of trademark or company affiliation, so the only reason that this company would have to contact us is if they stood to profit from it. In this case, it looks as if they're attempting to drum up registrations for their CN domains. Who knows what they would do with the payment info they receive. If you receive this message, which I've seen elsewhere, verbatim with the exception of the name in the sig, you can safely disregard it as a scam.

Hope this helps someone.

EDIT

Also a good resource for this kind of scam: http://www.europeandomaincentre.com/pages/news-room/domain-management-news/hey!-got-an-email-from-china-domain-name-registration-center-asian-domain-registration-service-in-china-the-department-of-registration-service-in-china-etc.#.VKqixod6ill

share|improve this answer

It sounds like a phishing email to me. If it was a real company asking for confirmation, they would only require confirmation action by you in order to approve the 'registration' and would not require action on your part in order to disapprove the 'registration'.

Also, the whole premise is bogus. The internet is free to register domain names even if they encroach on copyrights or trademarks (although there is certainly a path to file litigation).

Lastly, ask yourself if your company is even trying to get an Asian domain name. Likely, the answer is no...

Edit: http://www.hoax-slayer.com/domain-name-application-scam.shtml a simple google search will show numerous examples.

share|improve this answer
3  
"Lastly, ask yourself if your company is even trying to get an Asian domain name." The point is that a company that ISN'T you, is registering a domain that is SIMILAR to your company's name. –  HC_ Apr 21 '14 at 21:56
4  
I find it very hard to believe that there is some benevolent organization out there that just wants to know if approve of a cyber squatter... –  Matthew Peters Apr 21 '14 at 22:43

Our company received this kind of email today as well. It is really a big funny FAKE!

*(This is a very important case, so please transfer this email to your CEO or appropriate person. Thanks a lot.)
Dear CEO/Principal,

We are the department of Asian Domain Registration Service in China. Here I have something to confirm with you. We formally received an application on June 19, 2014 that a company claimed "ElsndYhen Company" were applying to register "domain" as their Net Brand and some "domain" Asian countries top-level domain names through our firm.

Now we are handling this registration, and after our initial checking, we found the name were similar to your company's, so we need to check with you whether your company has authorized that company to register these names. If you authorized this, we would finish the registration at once. If you did not authorize, please let us know within 7 workdays, so that we could handle this issue better. After the deadline we will unconditionally finish the registration for "ElsndYhen Company" Looking forward to your prompt reply.

Best Regards,
Eric Ma
Senior Consultant Manager*

They put a lot of effort in it, but two mistakes are obvious: The email came from: Eric Ma (ericm@nassco.net.cn) and this is a fake non existent domain. The signature is also poor in quality and indicates a existing domain registration service. But this is also one big bollocks: Under contact us the contact email is E-mail:tingjiang87@msn.cn and all the contact information are just one big FAKE.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.