A Fake China Domain Registry Warns Your CEO About .cn Names

The subject line was one word: the company's own name. The body warned that a third party was about to register that name as four Chinese domains, and it was marked "very urgent."

It was addressed to "Dear CEO." It landed in a public partnership-inquiry mailbox at a UK industrial equipment manufacturer.

The Pretext Is a Warning, Not an Offer

The message poses as a China domain name registration center. It says a request arrived "from our end" from a named applicant, and it lists the targets: the company's name as a .cn, a .com.cn, a .net.cn and a .org.cn, plus an "internet keyword." Then it asks one question: is this applicant your distributor in China?

Nothing is for sale in the email. There is no invoice, no portal, no fee. The scammer is not asking for money yet. The scammer is asking for a conversation.

That is the whole design. A company that owns a brand worries about someone else holding its name abroad. A reply of "no, not our distributor" is the opening the sender wants.

Where the Story Breaks

Every claim in the body can be checked against the headers, and none of them survive.

A real registry does not email trademark holders to ask about their distribution network. The sender says it received the applicant's request on the same calendar day the email itself was written. It signs as a Shanghai "General Manager / Domain Registry" and says it is in Shanghai, but the evidence points elsewhere.

The sending domain was created in 2022. This is not a freshly spun-up domain, so domain age tells you nothing here. The provenance tells you everything.

I will not claim the sender operates from Shanghai. Only the sending IP geolocation and registrar records are evidenced, so the accurate phrasing is that it claims to be in Shanghai.

See Your Risk: Calculate how many threats your SEG is missing

Full Authentication, Nothing to Scan

The message passed SPF, DKIM and DMARC, all aligned to the scammer's own domain, with a composite authentication pass from Microsoft. That is not a spoof. The scammer owns the domain and signed honestly.

This is where authentication-first thinking runs out. DMARC tells you who sent a message. It says nothing about whether the sender deserves a reply.

Then there is the payload problem. The incident record shows no links, no attachments and no QR codes. The only external reference is a hotlinked logo in the signature, a static image with no per-recipient token. A reputation engine that scores URLs and files has nothing to score. Microsoft still routed the message to Junk with a spam verdict, which is the right outcome, but it came from content signals rather than any artifact.

Under the 2026 DBIR, phishing remains the initial access vector in 16% of breaches, and pretexting accounts for 6% of initial access vectors. Reply-only approaches like this one live in that pretexting space, where the first message is designed to look harmless. The 2026 Verizon Data Breach Investigations Report also notes that AI-assisted text in malicious emails doubled year over year, which makes template-driven scams like this one easier to polish.

How It Was Caught

The detection came from language and community signals. Themis, the agentic AI virtual SOC analyst on the IRONSCALES platform, scored the message at 89 percent confidence. The SOC explanation matched it to known China domain-registration scam templates, with the same wording and signature pattern. Similar incidents had already been resolved as phishing. The sender was a first-time sender with no prior relationship to the recipient or the organization.

The affected mailbox was quarantined, and the incident was automatically resolved as phishing. Nobody replied, and no harm is recorded. This was an automated verdict, not a human analyst review.

The mapping is MITRE ATT&CK T1566, phishing, with the reply as the delivery of the next stage.

Indicators

What to Teach Your People

Teach one rule: nobody who writes to you about your own name is automatically on your side. Real registries do not ask who your distributors are. Unsolicited urgency aimed at "the CEO" via a shared mailbox is a pattern worth naming in awareness training.

For the security team, the lesson is narrower. A message with passing authentication and no artifacts is still a message. Put language and relationship signals ahead of link scoring, and layer M365 augmentation behind the native filter so that a Junk-folder verdict is not the last line of defense. Cross-check the sender's registrar record against the story in the body before anyone forwards it up the chain.