Explanation#

Upon reading the content, it became clear that it was a scam (targeting foreigners to deceive and potentially sell their information, such as email addresses, again).

The numerical information at the bottom is clearly incorrect. Although the numbers 96 and 97 at the end of the phone numbers seem realistic, they overlook a detail:

Fax numbers in China are typically 7 to 8 digits long, while international fax numbers are 10 digits.

Looking at the phone number again, 138 (China Mobile), 1642 (Shanghai), and 8671 do match the preceding information. However, it’s odd that a Chinese mobile number from Shanghai doesn’t have WeChat, isn’t it?

Also, it’s advised not to call this number. Source

A search for the address reveals that the top 10 results on Bing indicate it’s a scam.

Analysis#

Now, let’s examine the specific content (company and domain names).

Starting with the company mentioned:

whois#

Now, let’s look at these domain names (marisa.cn, marisa.com.cn, marisa.net.cn, marisa.org.cn).

Fortunately, they all have a .cn suffix, allowing us to directly query them through CNNIC’s WHOIS:

1
marisa.cn (parked and resold by Wanwang company)
2
marisa.com.cn (owned by an individual)
3
marisa.net.cn (empty, unregistered)
4
marisa.org.cn (same as above)

Different domains are registered by different entities, yet they target domain owners worldwide with .cn domains. How responsible of them!

Several domains remain unchecked, namely the array-like domain names in the title.

(Hint: The following information is compiled from officially available sources.)

The image’s domainregistry[.]net[.]cn (surprisingly, a blue-linked image, I’m perplexed)

1
WHOIS information for domainregistry.net.cn
2
Domain: domainregistry.net.cn
3
ROID: 20240606s10021s11762124-cn
4
Domain Status: ok
5
Registrant: Tan Xin
6
Registrant Contact Email: [email protected]
7
Sponsoring Registrar: Beijing Xinnet Digital Information Technology Co., Ltd.
8
Name Servers: ns11.xincache.com, ns12.xincache.com
9
Registration Date: 2024-06-06 18:58:12
10
Expiration Date: 2027-06-06 18:58:12
11
DNSSEC: unsigned

(Another org array)

1
WHOIS information for domainregistry.org.cn
2
Domain: domainregistry.org.cn
3
ROID: 20191121s10051s01430806-cn
4
Domain Status: ok
5
Registrant: Tan Xin
6
Registrant Contact Email: [email protected]
7
Sponsoring Registrar: Beijing Xinnet Digital Information Technology Co., Ltd.
8
Name Servers: ns11.xincache.com, ns12.xincache.com
9
Registration Date: 2019-11-21 11:06:19
10
Expiration Date: 2026-11-21 11:06:19
11
DNSSEC: unsigned

The sender’s netdomains[.]net[.]cn

1
WHOIS information for netdomains.net.cn
2
Domain: netdomains.net.cn
3
ROID: 20240928s10021s11822853-cn
4
Domain Status: ok
5
Registrant: Tan Xin
6
Registrant Contact Email: [email protected]
7
Sponsoring Registrar: Beijing Xinnet Digital Information Technology Co., Ltd.
8
Name Servers: ns11.xincache.com, ns12.xincache.com
9
Registration Date: 2024-09-28 11:24:01
10
Expiration Date: 2026-09-28 11:24:01
11
DNSSEC: unsigned

And the unmentioned chinaregistry[.]net[.]cn

1
WHOIS information for chinaregistry.net.cn
2
Domain: chinaregistry.net.cn
3
ROID: 20141215s10021s08521717-cn
4
Domain Status: ok
5
Registrant: Tan Xin
6
Registrant Contact Email: [email protected]
7
Sponsoring Registrar: Jiangsu Bangning Technology Co., Ltd.
8
Name Servers: ns1.sectigoweb.com, ns2.sectigoweb.com, ns3.sectigoweb.com, ns4.sectigoweb.com
9
Registration Date: 2014-12-15 09:29:08
10
Expiration Date: 2026-12-15 09:29:08
11
DNSSEC: unsigned

There are other arrays as well, but I won’t list them all here. Suffice it to say, CNNIC’s WHOIS is quite useful for querying related domains, and a familiar name keeps appearing.

What information appears most frequently? You understand, and so do I.

It can be basically concluded that some Chinese individuals are exploiting the guise of being “agents capable of selling .cn domains to foreigners” to send information to publicly available custom domain email addresses, tarnishing the reputation of Chinese domain registrars and their compatriots.

I won’t write more; it’s already late at night. Finally, I’ll add some indices (and translate them into English) to let more people know that XXregistry[.]x[.]cn is a complete scam.

用于索引#

谭鑫 注册者联系人邮件: 441695739[@]qq.com 注册者联系人邮件: nimesh[@]163.com domainregistry.net.cn domainregistry.org.cn chinaregistry.net.cn netdomains.net.cn 2161918696 2161918697 13816428671 +86-2161918696 +86-2161918697 +86-13816428671 12F Kaike Building, No. 1801 Hongmei Road, Shanghai 200233, China

Oh, and one more thing#

After registering a .cn domain for so long, I haven’t seen a filing number. There’s also the illegal registration of .cn domains for non-domestic entities (I haven’t seen many registrars on CNNIC capable of registering .cn domains for foreign entities).