A Fake China Domain Registry Warns Your CEO About .cn Names

A UK industrial company received a reply-only phishing email impersonating a China domain registration center claiming a third party was attempting to register the company’s name under Chinese domains; the message passed SPF/DKIM/DMARC, contained no links or attachments, and was intended to elicit a reply. Authentication aligned to the attacker-owned domain (cnnamedns.net) and headers revealed mismatches with the claimed origin; IRONSCALES and Microsoft quarantined or junked the message. The report maps the technique to MITRE T1566 and includes IoCs (sending email, domains, IP, and hotlinked image) and recommendations to prioritise language/relationship signals over link/file scoring in detections.