An email marked urgent asks to be forwarded to the CEO. A supposed registration center says another company is trying to claim your brand as an “internet keyword” and register matching .cn domains in China.
The message sounds like a courtesy before a costly trademark conflict. Its real power comes from a deadline, an unfamiliar process, and the fear that ignoring one email could hand your company’s name to a stranger.
Overview
The email invents a conflict around your existing brand
The Chinaregistry domain scam is a long-running business solicitation pattern. The sender claims that a third party has applied for an “internet keyword” and several Chinese domain names that match the recipient’s company, product, or website.
The message then asks whether the applicant is an authorized partner. That question makes the contact appear procedural, but it also invites the business owner to reply and confirm that the brand matters.
A supposed warning becomes an expensive sales demand
After the recipient objects, the sender may say the only way to stop the registration is to buy the domains first. The proposed package can include .cn, .com.cn, .net.cn, and .org.cn names for several years at prices far above ordinary registration costs.
The invented applicant and short deadline create pressure. The recipient is encouraged to act before consulting its normal registrar, trademark adviser, or legal team.
The story does not match normal domain registration practice
Registrars do not ordinarily email unrelated trademark owners to offer a paid “first refusal” whenever someone searches for a domain. Domain availability can be checked independently, and legitimate registrations should be handled through a registrar the business chooses.
- The email often opens with “Please forward this to your CEO.”
- It names a supposed applicant the recipient has never heard of.
- It groups several Chinese domain endings into a protection package.
- It uses a short deadline to discourage independent checks.
- A reply can lead to invoices, contracts, and repeated renewal demands.
Why the “Internet Keyword” Story Raises Questions
“Internet keyword” is used in these messages as though it were a global property right connected to a company name. The phrase is vague and does not explain which registry, policy, dispute process, or legal entitlement supposedly gives the recipient priority.
A real trademark can matter in a domain dispute, but it does not mean every registrar must offer the trademark owner a private pre-registration veto. Established domain disputes follow published rules and require evidence, not an urgent sales reply to an unknown broker.
The sender may quote the recipient’s real company name and current domain. That information is often public on a website, business directory, trademark database, or domain record. Personalization shows research, not legitimacy.
The simplest independent test is to contact the registrar that already manages your domains. Ask whether the named application or required package exists, and check the proposed names through a recognized registration service without using the sender’s links.
Domain Risk Can Be Real Even When the Email Is Not
Businesses do face cybersquatting, lookalike domains, phishing domains, and trademark misuse. That real risk helps this scheme sound plausible. The correct response, however, is a measured domain and trademark strategy rather than buying every name proposed by an unsolicited seller.
A company may decide that selected country-code domains are worth registering. That decision should consider the markets it serves, legal advice, renewal costs, brand-monitoring needs, and the registrar’s accreditation and contract terms.
Fear-based registration can grow without limit. Once a business pays for one group, another email can introduce alternate spellings, new endings, extra keywords, or a different supposed applicant.
ICANN’s information for domain registrants explains that owners manage domain settings through their registrar and can use ICANN’s lookup service to identify that registrar. Those independent channels are safer than relying on contact details inside an unsolicited sales message.
What a Genuine Domain Dispute Looks Like
A genuine domain conflict leaves a trail that can be checked. The disputed name exists in a public registry record, the registrar can be identified independently, and any formal complaint follows published rules rather than a private sales deadline.
Trademark owners may use established dispute procedures or a court when a registered name is being used in bad faith. Those processes require evidence and notices. They do not begin with an unknown salesperson offering a bundle of unused domains at a premium.
If the email names a company that supposedly wants your brand, search for that company outside the message. Then check each proposed domain separately through the registrar your organization already trusts. A name being available contradicts a claim that someone has completed its registration.
Why Replying Can Produce More Pressure
The first message is often written as a neutral question because a reply confirms three useful facts: the mailbox is monitored, the recipient controls brand decisions, and the proposed domains have emotional value to the business.
A follow-up can then sound more certain. It may introduce a manager, attach a price sheet, shorten the deadline, or claim that the other applicant has called again. Each detail gives the impression that an external process is moving forward.
Continuing the exchange also reveals names, direct telephone numbers, job titles, and internal concerns. Even if no purchase occurs, that information can support later impersonation attempts aimed at accounts, finance staff, or senior executives.
How the Chinaregistry Domain Scam Works
Step 1: Public business information supplies the target
The sender collects company names, executive titles, domains, and contact addresses from public websites or business records. A message can therefore mention a real brand and reach the person responsible for marketing, technology, or legal matters.
Small businesses are especially attractive because one owner may handle all those roles and may not have an established domain-protection process.
Step 2: A formal email announces a supposed application
The first contact claims that a named company has applied for matching Chinese domains and an internet keyword. It may say the application conflicts with the recipient’s company name, so confirmation is required before registration proceeds.
The tone is courteous, and the sender appears to be protecting the recipient. No invoice may appear yet, which lowers suspicion and encourages a simple reply.
Step 3: The recipient confirms that the applicant is unrelated
When the business says it has no connection to the applicant, the sender has learned that the brand owner is concerned. The reply also confirms a working contact address and may reveal the name and title of a decision-maker.
The supposed registrar can now change roles from neutral administrator to urgent brand-protection adviser.
Step 4: A deadline and warning increase the pressure
The follow-up may claim that the applicant insists on proceeding and that the recipient has only 24 or 48 hours to secure priority. It can warn about customer confusion, lost traffic, counterfeit goods, or damage in Asian markets.
Those risks are possible in general, but the message provides no independent evidence that the named applicant exists or made the claimed request.
Step 5: A multi-year registration package appears
The sender offers several domains together, often for multiple years. The invoice may mix registration, keyword protection, monitoring, and service fees, making the total difficult to compare with ordinary registrar pricing.
Payment may be requested by wire transfer or another method with limited buyer protection. A form may also request company registration documents, executive identification, signatures, or card details.
Step 6: Payment can lead to repeated solicitations
Even if some domains are registered, the buyer may receive little control, unclear credentials, inflated renewal charges, or registrations held in another party’s name. Paying also identifies the business as responsive to fear-based domain offers.
Future messages can introduce more endings, similar spellings, or additional brand conflicts. A one-time panic purchase can become an ongoing series of invoices.
Company, Address, and Fulfillment Checks
The email name is not proof of registry authority
Terms such as China Registry, domain center, brand protection, and registration service sound official but can be used by private sellers. Verify the exact legal entity, registrar status, and contractual role independently.
A Shanghai address does not prove the claimed process
Some versions include a detailed office address, telephone, fax, and employee title. An address can be copied, shared, virtual, outdated, or unrelated. Confirm the company through reliable records and the building operator when the transaction matters.
Support begins with pressure instead of service
A trustworthy registrar should explain pricing, ownership, transfer rights, renewal terms, nameservers, and cancellation in writing. A representative who refuses independent verification or keeps shortening the deadline is not offering a normal registration service.
Domain ownership replaces physical fulfillment
There is no shipped product in this scheme. The equivalent of fulfillment is control of the registered domain. The buyer should receive registrant status, account access, authorization codes, renewal control, and the ability to transfer the name.
How to Check a Domain Offer Safely
- Do not reply until the sender, company, domain, and claimed applicant are checked independently.
- Ask your existing registrar whether it recognizes the notice or sees any required action.
- Check each proposed domain through an established registrar or registration-data lookup service.
- Search the sender’s domain and telephone number with terms such as scam, complaint, and invoice.
- Ask for the registrar’s legal name, accreditation, full pricing, registrant terms, and transfer policy.
- Have trademark counsel review any genuine conflict that could materially affect the business.
Do not tell the unsolicited sender which names are strategically important. That information can help the seller refine the pressure or register an available name before you act through your own provider.
What to Do if You Have Fallen Victim to This Scam
- Stop further communication and payment. Do not sign another form, send identification, or buy additional domain endings. Preserve the conversation before blocking the sender.
- Contact the payment provider immediately. If you paid by card, wire, or another service, explain that the purchase followed a deceptive domain-conflict solicitation. Ask what recall, dispute, or card-replacement options remain available.
- Determine whether any domain was actually registered. Use an independent lookup and your normal registrar. Record the registrar, registrant data that is publicly available, creation date, nameservers, and status for each promised domain.
- Secure control of domains you received. Change the account password, enable multi-factor authentication, confirm the registrant email, and request transfer authorization codes. Move important names to a registrar you selected when contract rules allow.
- Protect documents and executive identities. If passports, business certificates, signatures, or employee details were shared, alert the relevant people and monitor for new accounts, forged requests, and targeted business email compromise.
- Warn accounting and IT staff. Tell colleagues which sender domains, names, invoices, and payment instructions were used. Scammers may approach another department after the first contact stops responding.
- Scan files and affected devices. If anyone opened an attachment or installed software, run a complete Malwarebytes scan. It can identify malicious documents, downloaders, and remote-access tools delivered alongside a fraudulent registration proposal.
- Reduce malicious follow-up traffic. AdGuard can block many known scam pages, deceptive ads, and tracking requests. It supports safer browsing, but the company must still verify registrar authority and contract terms independently.
- Report the activity. Report suspicious domain-related impersonation to the relevant registrar, hosting provider, ICANN channel, and national fraud authority. Include full email headers, invoices, payment instructions, and domains.
- Expect a second approach. A supposed lawyer or recovery firm may promise refunds or domain restoration for another fee. Verify any professional through an official registry and contact details found separately.
Frequently Asked Questions
Does another company really want my .cn domains?
The email alone does not prove that. Check availability and registration records independently, and ask your existing registrar or trademark adviser whether any verifiable conflict exists.
Must a registrar offer me first refusal because I own the trademark?
Not through the informal process described in these emails. Trademark rights can support formal disputes, but an unsolicited seller’s deadline is not itself a legal priority notice.
What is an “internet keyword” in this message?
The phrase is presented vaguely and should not be treated as a recognized global property right. Ask for the exact registry, governing policy, and enforceable benefit before considering any payment.
Should I register every Chinese version of my domain?
Not automatically. Choose domains according to your markets, brand risks, budget, and legal advice, then register them through a provider you independently selected.
What if the proposed domains are genuinely available?
Availability does not validate the sender’s applicant story. If a name matters, register it through your normal registrar without disclosing strategy to the unsolicited contact.
Can a detailed signature and office address make the email genuine?
No. Signatures, titles, addresses, and telephone numbers can be copied or invented. Verify the legal entity, registrar relationship, and payment recipient through independent records.
The Bottom Line
The Chinaregistry domain scam turns an ordinary brand-protection concern into an artificial emergency. A supposed third-party application supplies the fear, and a costly registration package supplies the proposed solution.
Do not let the sender define the deadline or the verification route. Check domains through your own registrar, involve trademark counsel when the risk is real, and pay only a provider whose identity and ownership terms you have independently confirmed.
A domain may be worth buying, but that business decision should never depend on an unverifiable stranger claiming that the CEO has 48 hours to act.
