Scam: dewiride | Chinese Domain Name Registration Conflict from Kevin Liu

This is a official email. We are the Domain Registration Service company in Shanghai, China. The Chinese domain name registration scam, back for the third time in our archive, sent from a nine-month-old domain with the same phone numbers and the same Shanghai address as the version we dissected in June 2024.

Complete Email

from: Kevin Liu kevin@cnnamesolution.net
date: 09/10/2026 11:53 PM
subject: dewiride

Email Body

(It's very urgent, hence we kindly ask you to send this message to your CEO. In case you think this has been emailed to you by mistake, please disregard it. Thanks.)
Dear CEO,
This is a official email. We are the Domain Registration Service company in Shanghai, China. I have an issue to confirm with you. On September 11, 2026, Jiazhi Ltd submitted an application to register "dewiride" as their internet keyword and Chinese domains (dewiride.cn, dewiride.com.cn, dewiride.net.cn, dewiride.org.cn). But after we review it, we notice this name conflicts with your company name or trademark. To resolve this issue properly, it's necessary to send a message to you and confirm if this firm is your distributor in China?

Best regards

Kevin Liu

General Manager

[an empty bordered box follows here — a signature image that never loaded]

Tel: +86-2161918696 | Fax: +86-2161918697 | Mob: +86-13816428671

12F Kaike Building, No. 1801 Hongmei Road, Shanghai 200233, China

---

Red Flags

This is the Chinese domain name registration scam — sometimes called domain slamming — and it is one of the longest-running templates in email fraud. The pitch never changes: a "registrar" in China has supposedly received an application from a third company to register your name as a set of .cn domains and an "internet keyword", has noticed the conflict, and is writing, out of professional courtesy, to check whether you authorised it. Nothing is asked for. The opening move exists purely to get a reply, because a reply is what turns a mass mailing into a sales conversation — and the sale is a set of overpriced, unnecessary domain registrations that you will be pressured into buying "before the other company does".

We have published this scam twice before: the Paul Liu / "China Registry" version in June 2024, and the Claire Peng / mtpio.cn version in August 2026. This copy is worth a third post because it demonstrates something the earlier two could not on their own: the same operation, running the same numbers from the same address, for at least two years and three months, changing nothing but the name at the bottom and the domain it sends from.

1. The Same Phone Numbers and the Same Address as June 2024

• Tel: +86-2161918696 | Fax: +86-2161918697 | Mob: +86-13816428671
• 12F Kaike Building, No. 1801 Hongmei Road, Shanghai 200233, China

Put this signature block next to the one in our June 2024 post and they are identical to the digit. Same landline, same fax, same mobile, same floor of the same building on the same road with the same postcode.

What has changed is everything around them. In 2024 the sender was Paul Liu, Service & Operations Manager, China Registry (Head Office), writing from paul@chinesedomain.org. Today it is Kevin Liu, General Manager of a company that is not named at all, writing from kevin@cnnamesolution.net. Two different organisations, two different job titles, two different people who happen to share a surname — and one set of contact details.

A real company can change its name, and a real person can change jobs. But a registrar that rebrands does not keep the old mobile number in the general manager's signature, and two unrelated firms do not share a fax line. The contact details are the constant because the contact details are the operation. The names and domains are disposable and are rotated as each one gets blocked or reported; the numbers are where the eventual phone calls land, so they stay.

2. A Nine-Month-Old Domain With No Website, for a Company That Sells Domains

• from: Kevin Liu kevin@cnnamesolution.net

The sending domain's public registration record tells the story on its own:

• Created: 12 December 2025 — nine months before this email was sent.
• Expires: 12 December 2026 — a single year, the minimum term. Nobody planning to be in business next year registers their company's primary domain for twelve months.
• No website. The domain has no web address record at all. www.cnnamesolution.net does not resolve to anything.
• Mail hosted on Google Workspace. The only thing configured is a mailbox — a consumer-grade business email subscription attached to a domain that otherwise does not exist.

Read those four facts together: this is a domain that was set up to send email and nothing else, on the shortest possible term, by someone who expects to discard it. That is the profile of a throwaway sending domain, and it is the exact opposite of the profile of a "Domain Registration Service company" — a business whose entire trade is domains, and which cannot be bothered to put a web page on its own.

There is a second, quieter mismatch. A registrar in Shanghai whose business is .cn domains, writing to warn you about .cn domains, sends from a .net. The 2024 version sent from a .org; the Claire Peng version sent from a .cn but advertised a website on .org.cn. The operation never quite lives on the infrastructure it claims to be selling.

3. The Application Date Is the Send Date, Down to the Hour

• On September 11, 2026, Jiazhi Ltd submitted an application to register "dewiride"...

This email arrived at 11:53 PM on 10 September, Indian time. Shanghai is two and a half hours ahead, so it was sent at about 2:23 AM on 11 September local time. The message therefore asserts that, in the first two hours and twenty minutes of 11 September, a company called Jiazhi Ltd filed an application, the registrar reviewed it, the review flagged a trademark conflict with a company in India, and the General Manager personally composed and sent a courtesy enquiry — all before half past two in the morning.

That is not a timeline. It is a merge field. The 2024 version of this exact template said "We received an application from Hongshun Ltd on June 5, 2024" and was sent on 5 June 2024. The application date is always today because it is filled in by the mailing tool at send time, and it is always today because "today" is the most urgent-sounding value the field can hold.

"Jiazhi Ltd", like "Hongshun Ltd" before it and "Wergass Global Ltd" in the Claire Peng copy, is a name with nothing behind it — no registration number, no address, no website, no representative. It is a plausible-sounding two-syllable name followed by Ltd, generated to be a rival. The rival is the entire threat, and the threat has no more substance than the name.

4. Registrars Do Not Work This Way — In China or Anywhere Else

• We notice this name conflicts with your company name or trademark. ... it's necessary to send a message to you and confirm if this firm is your distributor in China?

Domain registration everywhere, including under CNNIC, the body that administers .cn, is first come, first served. A registrar receiving an application for dewiride.cn registers it. It does not run a worldwide trademark search, does not identify a company in India as a possible rights-holder, and does not hold the application while it emails that company for permission. There is no mechanism for it to do so and no obligation that would make it try.

Trademark conflicts in .cn are handled the way they are handled in every other namespace: after registration, through a dispute process the rights-holder initiates, with evidence. No registrar has a role that involves pre-clearing a stranger's application with a foreign company by cold email, and no registrar's General Manager writes those emails personally.

The question at the end is also carefully chosen. "Confirm if this firm is your distributor in China?" is a yes-or-no question with no safe answer. Say no, and the next email explains that the application will proceed unless you register the names first. Say yes, and you have just confirmed a business relationship that does not exist. Say anything at all, and you are in the conversation, which is the only thing this email was ever for.

5. "Forward This to Your CEO" — Sent to a Billing Mailbox

• (It's very urgent, hence we kindly ask you to send this message to your CEO. In case you think this has been emailed to you by mistake, please disregard it. Thanks.)
• Dear CEO,

The opening parenthesis is the giveaway that the sender has no idea who they are writing to. It arrived in a billing mailbox — a functional address published for invoices — and asks whoever reads it to walk it upstairs. A registrar that had really identified a trademark conflict with a named company would have looked that company up and written to a named person. This one has an address scraped from somewhere and a keyword, and is asking the recipient to do the targeting for it.

The tactic is deliberate. Routing a message "to the CEO" moves it past the people whose job is to be sceptical of unsolicited vendors and puts it in front of the person most likely to react to the words urgent, trademark, and China on instinct. The instruction to forward is the social-engineering payload of the first message.

Then there is the escape hatch: "In case you think this has been emailed to you by mistake, please disregard it." Genuine urgent notices do not invite you to ignore them. This line exists so that the great majority of recipients who do not respond feel no need to report it either — it is pre-emptive spam-filter insurance, written by someone who expects most of the list to be a miss.

6. A 2024 Template With the Words Swapped

• This is a official email. We are the Domain Registration Service company in Shanghai, China.

Set the two versions side by side:

June 2024 (Paul Liu)	September 2026 (Kevin Liu)
If you are NOT CEO, please kindly forward this to your CEO, because this is urgent	It's very urgent, hence we kindly ask you to send this message to your CEO
This email is from China domain name registration center in Shanghai, China	This is a official email. We are the Domain Registration Service company in Shanghai, China
We received an application from Hongshun Ltd on June 5, 2024	On September 11, 2026, Jiazhi Ltd submitted an application
internet keyword and China (CN) domain names	internet keyword and Chinese domains
we find this name conflict with your company name or trademark	we notice this name conflicts with your company name or trademark
In order to deal with this matter better	To resolve this issue properly
confirm whether this company is your business partner in China	confirm if this firm is your distributor in China

Every sentence maps one-to-one. The sentences are in the same order, make the same claims, and end with the same question. What has changed is the vocabulary — business partner becomes distributor, deal with this matter better becomes resolve this issue properly — which is what happens when a template is run through a synonym-spinning tool so that filters trained on the old wording do not match the new one.

The spin has introduced its own errors. "This is a official email" should be an official; "the Domain Registration Service company" is a job description with capital letters, not a name. The grammar of the 2024 copy ("we find this name conflict") was fixed, but nobody proofread what replaced it. That is the signature of automated rewriting rather than a person writing.

7. A General Manager With No Company Name and No Logo

• Kevin Liu / General Manager

The 2024 version at least claimed an employer: China Registry (Head Office). This one names none. Kevin Liu is the General Manager of "the Domain Registration Service company", which is not a name, and the email domain cnnamesolution.net is never mentioned in the body or signature as a company at all.

Beneath the job title, the mail client rendered an empty bordered box — the outline of an image that was supposed to be there. That is a signature logo hosted somewhere the client refused to fetch from, or one that was never uploaded. Either way, the one visual element that would have identified the organisation is a blank rectangle, and the sender either did not test the template or did not care.

A real General Manager also has more to do than personally handle a single conflicting application at two in the morning. In genuine registrars, that work — if it existed — would sit with a compliance or support desk with a ticket number. The senior title is here for the same reason as the Shanghai address and the three phone numbers: to make an anonymous message look like it comes from somewhere.

8. The Subject Line Is Just Your Own Name

• subject: dewiride

One word, lowercase, no context: the target's brand and nothing else. It matches the Claire Peng copy exactly, whose subject was simply jd-bots. The subject is the same merge field as the "internet keyword" in the body — the mailing tool takes the domain name from the address list, strips the extension, and uses the result everywhere a name is needed.

It is an effective subject, because a message that is titled with your own company name is hard not to open. But it is also a message whose author knows nothing about you except the string before the @. It does not know your company's full name, your trademark, your CEO, or whether you have any interest in China at all. It knows a keyword, and it has built an entire trademark emergency around it.

---

How This Scam Works

The first email is a probe. It asks for no money, contains no link, and would pass a casual read as a slightly clumsy courtesy note. Its single purpose is to find, among many thousands of recipients, the ones who will reply — because a reply identifies a business that owns a name, cares about it, and is worried enough to write back.

1. The List: Domain names are harvested in bulk from WHOIS records, company directories, and the web. The domain is split at the dot — the part before it becomes the "internet keyword" and the subject line, the address it came with becomes the recipient. No further research is done and none is needed.
2. The Template: A script that has been in use for well over a decade is loaded into a mailing tool. The applicant company and the application date are merge fields. Every few months the wording is spun to evade filters, and the sending domain is replaced — this time with a nine-month-old .net whose only configured service is a mailbox.
3. The Blast: The same message goes to every address on the list. Most copies are junked, as this one was. The sender's escape clause — please disregard it — is there to keep the misses quiet.
4. The Reply: A recipient writes back to say that no, Jiazhi Ltd is not their distributor and they did not authorise anything. This is the only outcome the first email was designed to produce, and from here the conversation becomes personal.
5. The Dilemma: The "registrar" responds with regret. Under its rules, it explains, it cannot refuse Jiazhi Ltd's application on your word alone. The only way to protect the name is for you, as the rightful owner, to register it first — and as a courtesy, it can give you priority for a few days.
6. The Quote: A price list arrives. dewiride.cn, dewiride.com.cn, dewiride.net.cn, dewiride.org.cn, plus the "internet keyword", typically for a ten-year term, at a per-name price several times what any accredited registrar charges. The total runs into the thousands of dollars, and it is framed as the cost of stopping a competitor rather than the cost of buying domains.
7. The Deadline: Jiazhi Ltd is said to be pressing for an answer. A date is set. The "General Manager" is on your side, but the applicant's lawyers are impatient and the window is closing. Every message from here restates the deadline.
8. The Payment: A wire transfer to a Chinese bank account, or a card payment through a page on a domain you have never heard of. Once it clears, one of three things happens: nothing at all; a set of domains registered in the scammer's name, which you do not control; or domains registered in your name at a wildly inflated price that you could have bought yourself for a few dollars each.
9. The Renewal: If the domains were actually registered, the operation now holds your billing details and a reason to write every year. Renewal notices arrive at the same inflated price, with the same warning that the names will be lost if you do not pay. This is where the fake domain renewal phishing in our archive picks up the same victim.
10. The Rival Returns: Alternatively, the "applicant" comes back — this time wanting dewiride.asia, dewiride.hk, dewiride.tw, or a new keyword — and the cycle restarts. A business that paid once is a business that will be asked again, from a new name and a new domain, using the same phone numbers.

---

Conclusion and Recommendations

There is no Jiazhi Ltd, no pending application, and no registrar reviewing it. There is a two-year-old script, a synonym spinner, a mailbox on a domain registered for twelve months last December, and a Shanghai address that has been signing these emails under at least two different names since before our first post about it. The company in India whose "trademark" is supposedly in danger was identified by cutting a string off the front of an email address.

The instructive thing about this copy is not any one detail — the Claire Peng post covers the template well — but the persistence. The same phone numbers, the same fax, the same mobile, the same building. An operation that has been reported, filtered, and written up for years and has not needed to move, because moving is unnecessary when the names and domains are disposable and the target list is infinite. The next copy will arrive from a fourth domain signed by a third Liu, and the Kaike Building will still be at the bottom.

The mail client did its job here: the message was junked, its links were disabled, and it was tagged as external before anyone read it. That is worth noting, and it is not the defence. The defence is knowing that no registrar, anywhere, will ever email you to ask whether a stranger may register your name — so the day one does, you already know what the next email will be selling.

Immediate Actions:

• Do Not Reply, Even to Say No: "No, they are not our distributor" is the reply this email is built to receive. It confirms a live business that cares about the name and moves you into the sales sequence. There is no answer to the question that costs the sender anything, so do not give one.
• Do Not Forward It to Your CEO: The forwarding instruction is the social-engineering payload of the first message. Send it to the person who handles security or IT instead, with a one-line note that it is a known scam, so it is recognised rather than escalated.
• Do Not Call the Numbers: The phone numbers are the durable part of this operation and are staffed. A call confirms your interest, hands over your number, and puts you on the line with a salesperson trained for exactly this conversation.
• Report as Phishing, Then Delete: Use the mail client's report function rather than plain deletion so the sending domain is scored and, on a corporate system, your security team sees it. cnnamesolution.net is nine months old and will be replaced; every report shortens its useful life.
• Warn Whoever Else Reads the Shared Mailbox: This arrived in a billing mailbox. Functional mailboxes are read by several people, and the next copy may be opened by someone who has not seen this analysis.
• If Anyone Has Already Paid, Escalate Now: Contact your bank immediately about a recall, preserve every message and receipt, and report it — in India, through the National Cyber Crime Reporting Portal at cybercrime.gov.in or the 1930 helpline. If domains were actually registered in your name, check their WHOIS and, if they are genuinely yours, transfer them to an accredited registrar before the inflated renewal falls due.

Verification Steps:

• Search the Phone Numbers Before Anything Else: +86-2161918696 and +86-13816428671 are the fastest verification available. They return this scam, under multiple names, going back years — including our own June 2024 post. Phone numbers are harder to rotate than domains, which makes them the best search term in the message.
• Look Up the Sending Domain's Age: Any WHOIS service shows cnnamesolution.net created in December 2025 on a one-year term with no website. A registrar whose own domain is younger than most of its supposed customers, and has no web presence, is not a registrar.
• Ask Whether the Process Described Exists: It does not. .cn registration is first come, first served. Conflicts are resolved by dispute after the fact, initiated by the rights-holder, not by a registrar emailing foreign companies before registering a name. Any claim of a courtesy pre-check is invented.
• Check the Applicant: "Jiazhi Ltd" has no registration number, no address, no website, and no representative — nothing that could be verified. A real conflicting applicant would be identifiable, because a real dispute needs a party on the other side.
• Compare the Date in the Body With the Date on the Email: They are the same day. Then work out the local time. An application received, reviewed, and escalated to the General Manager before 2:30 AM is a merge field, not a sequence of events.
• Check Whether You Actually Want the Domains: If dewiride.cn matters to your business, register it yourself, today, through any accredited registrar, for a few dollars a year. If it does not, nobody registering it can hurt you, and the "threat" evaporates. Either way, the person emailing you is not part of the decision.
• Read the Display Name Against the Company: "Kevin Liu, General Manager" of a company that is never named, at a domain that is never mentioned, above a logo that never loaded. Every field that should identify the organisation is empty or generic.

---

Additional Protection Tips

• Know the Template by Heart: Registrar in China, application from an unknown Ltd, internet keyword plus four .cn variants, conflicts with your trademark, are they your partner / distributor / agent? Those five elements have appeared in that order for over fifteen years. Learn the skeleton once and every rewording is recognisable from the first line.
• Understand That Nobody Guards Your Name for Free: No registry or registrar monitors trademarks on your behalf and writes to warn you. If protecting a name in a namespace matters, that is a service you buy from a brand-protection firm or a trademark attorney — never something a stranger volunteers by email.
• Register What You Actually Need, Proactively: If a market matters to your business, register its country-code domain before anybody offers to. It costs almost nothing, it removes the only lever this scam has, and it means the next Kevin Liu is writing about a name you already own.
• Treat "Forward to Your CEO" as a Stop Sign: A legitimate correspondent who needs the CEO looks up the CEO. A message that asks the reader to do the targeting for it is a mass mailing, and one that specifically wants to bypass the people whose job is to be sceptical.
• Search Phone Numbers, Not Just Domains: Scam operations rotate names and domains constantly because they are cheap; they keep phone numbers because calls have to land somewhere. When a message gives you a number, search it. It is often the only fixed point.
• Let a Missing Website Speak: A company whose domain has a mailbox and nothing else has set up a domain for sending, not for being found. That is worth checking for any unsolicited vendor, and it takes ten seconds.
• Keep Domain Decisions With the People Who Manage Domains: Set a rule that no domain, keyword, or renewal is ever purchased from an inbound email, and that all domain spending goes through whoever manages your existing registrar account. Most domain scams — this one, the fake WordPress renewal, the final warning renewal notice — depend on the decision being made by someone who does not.
• Expect the Next Copy: This operation has written to us in 2024 and twice in 2026, under three names, from three domains. It will write again. The value of recognising it is not this email but the next ten, which is why the Network Service Company version from December 2024 is worth reading alongside this one.

Remember: No registrar will ever email to ask whether a stranger may register your name, because that is not how domain registration works anywhere in the world. When a "registrar" writes to warn you, it is not protecting your name — it is selling it to you.

---