“Final reminder” #domain spammer using Chinese registrar West.CN

Phuck all spammers.

If you’ve been getting a lot of domain-related spam with “Final Reminder” in the subject, you are not alone.

Some phuckstick is using China’s domain registrar, CHENGDU WEST DIMENSION DIGITAL TECHNOLOGY CO., LTD to send thousands of unsolicited emails, with fake expiration notices.

Here’s a sample email from this bastard:

FINAL NOTICE – Your account is pending cancellation
We have NOT received your payment yet
Domain Name:
Registration Period:
Term:  ***.com 02/14/2018 to 02/14/2019 $67.00 1 Year
Failure to complete this order by 01/31/2018 . may result in the cancellation of this offer (making it difficult for your customers to locate you, using search engines on the web). We do not register or renew domain names. We sell traffic generator software.

The cybercriminal uses random .org domains as the “reply-to” email address, but the emails contain a link to a different domain name.

The WHOIS points to this domain scammer, spamming thousands of domain owners:

Registrant Name: wang bing
Registrant Organization: wang bing
Registrant Street: cuixiangjiedao112haoAzuo
Registrant City: zhuhai
Registrant State/Province: Guangdong
Registrant Postal Code: 519000
Registrant Country: CN
Registrant Phone: +86.75652001255
Registrant Phone Ext:
Registrant Fax: +86.75652001255
Registrant Fax Ext:
Registrant Email:

According to DomainTools and Reverse WHOIS, the same wanker owns the following spam-enabling domain names to bombard domainers with this fake “final warning” spam:

All of the above have the same WHOIS information. If you have received such emails, report them to the Registrar.

If the registrar does not comply, report them to ICANN.

Copyright © 2018 · All Rights Reserved.


2 Responses to ““Final reminder” #domain spammer using Chinese registrar West.CN”
  1. from says:

    hi, thanks for pointing out this issue, we have contacted the registrant already. we will solve it as soon as possible

  2. DomainGang says: – Thanks, but we are still getting those emails today. You need to disable the spammer’s domain names.

Leave a Reply

Your email address will not be published. Required fields are marked *

 characters available