It has been a while since anybody tried to talk me into registering a domain name I wasn't sure I wanted in the first place, but it has happened before. Scams more or less like the Swedish one are as common as they are transparent, but apparently enough people take the bait that the scammers keep trying.
Note: This piece is also available without trackers but classic formatting only here.
After a few quiet years in my backwater of the Internet, in March of 2016, we saw a new sales push that came from China. The initial contact on March 4th, from somebody calling himself Jim Bing read (preserved here with headers for reference, you may need MIME tools to actually extract text due to character set handling),
Note: See the Scam to register asian domain names page, maintained by Systonic for a comprehensive list of identified domain name scams. (added 2025-03-17, thanks @netresec!)
Subject: Notice for "bsdly"
Dear CEO,
(If you are not the person who is in charge of this, please forward this to your CEO, because this is urgent, Thanks)
We are a Network Service Company which is the domain name registration center in China.
We received an application from Huabao Ltd on March 2, 2016. They want to register " bsdly " as their Internet Keyword and " bsdly.cn "、" bsdly.com.cn " 、" bsdly.net.cn "、" bsdly.org.cn " 、" bsdly.asia " domain names, they are in China and Asia domain names. But after checking it, we find " bsdly " conflicts with your company. In order to deal with this matter better, so we send you email and confirm whether this company is your distributor or business partner in China or not?
Best Regards,
Jim
General Manager
Shanghai Office (Head Office)
8006, Xinlong Building, No. 415 WuBao Road,
Shanghai 201105, China
Tel: +86 216191 8696
Mobile: +86 1870199 4951
Fax: +86 216191 8697
Web: www.cnweb-registry.com
The message was phrased a bit oddly in parts (as in, why would anybody register an"internet keyword"?), but not entirely unintelligible as English-language messages from Asians sometimes are.
I had a slight feeling of deja vu -- I remembered a very similar message turning up in 2008 while we were in the process of selling the company we'd started a number of years earlier. In the spirit of due diligence (after asking the buyer) we replied then that the company did not have any plans for expanding into China, and if my colleagues ever heard back, it likely happened after I'd left the company.
This time around I was only taking a break between several semi-urgent tasks, so I quickly wrote a reply, phrased in a way that I thought would likely make them just go away (also preserved here):
Subject: Re: Notice for "bsdly"
Dear Jim Bing,
We do not have any Chinese partners at this time, and we are not
currently working to establish a presence in Chinese territory. As to
Huabao Ltd's intentions for registering those domains, I have no idea
why they should want to.
Even if we do not currently plan to operate in China and see no need
to register those domains ourselves at this time, there is a risk of
some (possibly minor) confusion if those names are to be registered
and maintained by a third party. If you have the legal and practical
authority to deny these registrations that would be my preference.
Yours,
Peter N. M. Hansteen
Then on March 7th, a message from "Jiang zhihai" turned up (preserved here, again note the character set issues):
Subject: " bsdly "
Dear Sirs,
Our company based in chinese office, our company has submitted the " bsdly " as CN/ASIA(.asia/.cn/.com.cn/.net.cn/.org.cn) domain name and Internet Keyword, we are waiting for Mr. Jim's approval. We think these names are very important for our business in Chinese and Asia market. Even though Mr. Jim advises us to change another name, we will persist in this name.
Best regards
Jiang zhihai
Now, if they're in a formal process of getting approval for a that domain name, why would they want to screw things up by contacting me directly? I was beginning to smell rat, but I sent them an answer anyway (preserved here):
Subject: Re: " bsdly "
Dear Jiang zhihai,
You've managed to make me a tad curious as to why the "bsdly" name
would be important in these markets.
While there is a very specific reason why I chose that name for my
domains back in 2004, I don't see any reason why you wouldn't be
perfectly well served by picking some other random sequence of characters.
So out of pure curiosity, care to explain why you're doing this?
Sincerely,
Peter N. M. Hansteen
Yes, that domain name has been around for a while. I didn't immediately remember exactly when I'd registered the domain, but a quick look at the whois info (preserved here) confirmed what I thought. I've had it since 2004.
Anyone who is vaguely familiar with the stuff I write about will have sufficient wits about them to recognize the weak pun the domain name is. If "bsdly" has any other significance whatsoever in other languages including the several Chinese ones, I'd genuinely like to know.
But by now I was pretty sure this was a scam. Registrars may or may not do trademark searches before registering domains, but in most cases the registrar would not care either way. Domain registration is for the most part a purely technical service that extends to making sure whether any requested domains are in fact available, while any legal disputes such as trademark issues could very easily be sent off to the courts for the end users at both ends to resolve. The supposed Chinese customer contacting me directly just does not make sense.
Then of course a few hours after I'd sent that reply, our man Jim fired off a new message (preserved here, MIME and all):
Subject: CN/ASIA domain names & Internet Keyword
Dear Peter N. M. Hansteen,
Based on your company having no relationship with them, we have suggested they should choose another name to avoid this conflict but they insist on this name as CN/ASIA domain names (asia/ cn/ com.cn/ net.cn/ org.cn) and internet keyword on the internet. In our opinion, maybe they do the similar business as your company and register it to promote his company.
According to the domain name registration principle: The domain names and internet keyword which applied based on the international principle are opened to companies as well as individuals. Any companies or individuals have rights to register any domain name and internet keyword which are unregistered. Because your company haven't registered this name as CN/ASIA domains and internet keyword on the internet, anyone can obtain them by registration. However, in order to avoid this conflict, the trademark or original name owner has priority to make this registration in our audit period. If your company is the original owner of this name and want to register these CN/ASIA domain names (asia/ cn/ com.cn/ net.cn/ org.cn) and internet keyword to prevent anybody from using them, please inform us. We can send an application form and the price list to you and help you register these within dispute period.
Kind regards
Jim
General Manager
Shanghai Office (Head Office)
8006, Xinlong Building, No. 415 WuBao Road,
Shanghai 201105, China
Tel: +86 216191 8696
Mobile: +86 1870199 4951
Fax: +86 216191 8697
Web: www.cnwebregistry.com
So basically he's fishing for me to pony up some cash and register those domains myself through their outfit. Quelle surprise.
I'd already checked whether my regular registrar offers .cn registrations (they don't), and checking for what looked like legitimate .cn domain registrars turned up that registering a .cn domain would likely cost to the tune of USD 35. Not a lot of money, but more than I care to spend (and keep spending on a regular basis) on something I emphatically do not need.
So I decided to do my homework. It turns out that this is a scam that's been going on for years. A search on the names of persons and companies turned up Matt Lowe's 2012 blog post Chinese Domain Name Registration Scams with a narrative identical to my experience, with only minor variations in names and addresses.
Checking whois while writing this it turns out that apparently bsdly.cn has been registered:
[Wed Mar 09 20:34:34] peter@skapet:~$ whois bsdly.cn
Domain Name: bsdly.cn
ROID: 20160229s10001s82486914-cn
Domain Status: ok
Registrant ID: 22cn120821rm22yr
Registrant: 徐新荣
Registrant Contact Email: 1725093@qq.com
Sponsoring Registrar: 浙江贰贰网络有限公司
Name Server: ns1.22.cn
Name Server: ns2.22.cn
Registration Time: 2016-02-29 20:55:09
Expiration Time: 2017-02-28 20:55:09
DNSSEC: unsigned
But it doesn't resolve more than a week after registration:
[Wed Mar 09 20:34:47] peter@skapet:~$ host bsdly.cn
Host bsdly.cn not found: 2(SERVFAIL)
That likely means they thought me a prospect and registered with an intent to sell, and they've already spent some amount of cash they're not getting back from me. I think we can consider them LARTed, however on a very small scale.
What's more, none of the name servers specified in the whois info seem to answer DNS queries:
[Wed Mar 09 20:35:36] peter@skapet:~$ dig @ns1.22.cn bsdly.cn any
; <<>> DiG 9.4.2-P2 <<>> @ns1.22.cn bsdly.cn any
; (2 servers found)
;; global options: printcmd
;; connection timed out; no servers could be reached
[Wed Mar 09 20:36:14] peter@skapet:~$ dig @ns2.22.cn bsdly.cn any
; <<>> DiG 9.4.2-P2 <<>> @ns2.22.cn bsdly.cn any
; (2 servers found)
;; global options: printcmd
;; connection timed out; no servers could be reached
So summing up,
- This is a scam that appears to have been running for years.
- If something similar to those messages start turning up in your inbox, the one thing you do not want to do is to actually pay for the domains they're offering.
Most likely you do not need those domains, and it's easy to check how far along they are in the registration process. If you have other contacts that will cheaply and easily let you register those domains yourself, there's an element of entertainment to consider. But keep in mind that automatic renewals for domains you don't actually need can turn irritating once you've had a few laughs over the LARTing. - If you are actually considering setting up shop in the markets they're offering domains for and you receive those messages before you've come around to registering domains matching your trademarks, you are the one who's screwed up.
Sending near-identical email messages to people listed in various domains' whois info does not require a lot of resources, and as Matt says in his article, there are indications that this could very well be the work (for some values of) of a single individual. As cybercrime goes, this is the rough equivalent of some petty, if unpleasant, street crime.
I'm all ears for suggestions for further LARTing (at least those that do not require a lot of effort on my part), and if you've had similar experiences, I'd like to hear from you (in comments or email). Do visit Matt Lowe's site too, and add to his collection if you want to help him keep track.
And of course, if "Jim Bing" or Jiang zhihai" actually answer any of my questions, I'll let you know with an update to this article.
Update 2016-03-15: As you can imagine I've been checking whether bsdly.cn resolves and the registration status of the domain via whois at semi-random intervals of at least a few hours since I started the blog post. I was a bit surprised to find that the .cn whois server does not answer requests at the moment:
[Tue Mar 15 10:23:31] peter@portal:~$ whois bsdly.cn
whois: cn.whois-servers.net: connect: Connection timed out
It could of course be a coincidence and an unrelated technical issue. I'd appreciate independent verification.
Update 2016-11-03: Another variant of the same appeared today, with one "Kenn Lau <kenn@qosl.org.cn>" given as the contact. The full message including headers can be found here.
The main message is:
From: Kenn Lau <kenn qosl.org.cn>
To: peter <peter nuug.no>
Subject: nuug
Date: Thu, 3 Nov 2016 19:00:25 +0800
The question is closely related to your company name "nuug",please forward it to your company's top management. Thanks!
Dear President&CEO,
We are the organization specializing in network consulting and registration authorized by Chinese government. On November 2. 2016,a applicant named Mr. Brian Lee from BIO Technologies Co., Ltd wants to record and register the brand name nuug and some domains by our office.
After our preliminary review and verification,we find BIO Technologies Co., Ltd has nothing to do with your company. But If you have permitted this company to apply these names, or you think the application will not damage the interests of your company,please allow us to fulfill all the registration for BIO Technologies Co., Ltd. If you against the company's application,please let me know by email ASAP.
Best Regards,
Kenn Lau
Manager of Registration department
Address:No. 68 FuNan Road,Hefei 230000,China
Tel: (+86) 0739-5266069
Fax:(+86) 0739-5266069
I'm sure Kenn would like to hear from you, and of course I'm happy to hear from you if you hear from him too.
Update 2025-01-20: They are still at it, of course. In today's overnight incoming, a message from "Jeff Liu" (jeff@cndomainname.cn) turned up, saying,
(It's very urgent, therefore we kindly ask you to forward this email to your CEO. If you believe this has been sent to you in error, please ignore it. Thanks)Dear CEO,We are the domain registration and solution
+center in China. We received an application from Hongfei Ltd on January 20, 2025. They want to apply for "bsdly" as their internet keyword and China (CN) domain names (bsdly.cn, bsdly.com.cn, bsdly.net.cn,
+bsdly.org.cn). But after checking it, we find this name conflict with your company name or trademark. In order to deal with this matter better, it's necessary to send email to you and confirm whether this
+company is your distributor in China? Best regardsJeff Liu
General Manager
Name Registry
Tel: +86-2161918696 Fax: +86-2161918697 Mob: +86-13816428671
12F Kaike Building, No. 1801 Hongmei Road, Shanghai 200233, China
I have preserved the message as a plaintext version as well as the original MIME-encoded form.
Once again, please remind anyone who mentions this that this is a scam and to just ignore the message. Nothing bad will happen, and you will have money to put to some productive use.
Also note that if any links to previous messages or other matierial are not functional, please let me know. Fatfingering may have happened, but most things are restoreable.
Update 2025-03-10: A new campaign is in progress, now with "Mike Lee(Mr.)" mike.lee@ygnet25.net.cn using mike.lee@netprovider.com.cn as a reply-to.
The body of the message:
Dear Manager,
(Please forward this to your CEO, because this is urgent. Thanks!)
I'm Mike Lee(Mr.), a Services & Operating Manager here in Shanghai, China, with the domain name registration center.
On March 10, 2025, we received an application from Shangmao Holdings Ltd requested “undeadly ” as their internet
keyword and China (CN) domain names( undeadly.cn/ undeadly.com.cn/ undeadly.net.cn/ undeadly.org.cn).
After checking it, we find this name conflict with your company name or trademark. In order to deal with this matter
better, it's necessary to send email to you and confirm whether your company have affiliation with this chinese company?
Kind regards
Mike
=============================
MIKE LEE(Mr.) | Services & Operating Manager
Room 1714, Building A, No. 172 Yuyuan Road, Shanghai 200040, China
T: 0086 13 48 281 91 47 | Tel: 0086 21 619 186 96 | Fax: 0086 21 619 186 97
-----------------------------------------------------------------------------------------------------
Tip: Please Add mail sender account to your contacts to make sure our response does not end up in your spam folder.
The message as mbox is here for further studies.
Update 2025-04-07: Another campaign message managed to inbox today, this time with sender
Simon Liu <simon@netdomains.net.cn>, added to the archive of course.
Update 2025-08-13: They"re back. Another campaign message managed to inbox today, this time with sender Frank Liu <frank@chinaname.org>, sending from mx.chinanetname.org [104.244.78.14]. Added to the archive of course.
Posts
