Moon of Alabama Brecht quote
September 20, 2022

'Slamming' Moon of Alabama

Two weeks ago I received this unexpected email:

Subject: moonofalabama
From: Albert Liu <albert@china*******.org>
Date: 9/3/2022, 3:56 PM
To: moonofa <[email protected]>

(If you are NOT CEO, please kindly forward this to your CEO, because this is urgent. If you believe this has been sent to you in error, please ignore it. Thanks)

Dear CEO, This email is from China domain name registration center, which mainly deal with the domain name registration in China. On September 3, 2022, we received an application from Hongfeng Ltd requested "moonofalabama" as their internet keyword and China (CN) domain names (,,, But after checking it, we find this name conflict with your company name or trademark. In order to deal with this matter better, it's necessary to send email to you and confirm whether this company is your business partner in China?

Best Regards
Albert Liu | Service & Operations Manager
China Registry (Head Office)

As I have been on the Internet for 30+ years I found this funny and was happy to play my role in it.

I wrote back to Mr. Liu, expressing my serious concern that some company would use Moon of Alabama domains to then possibly scrap off my content and to put advertisements around it:

Hongfeng Ltd will presumably copy content from my site to reproduce it for profit under similar named Chinese domain.
While I can not prevent this it is not good for the globally recognized name of my blog.
I ask you, if possible, to not give those domain to Hongfeng Ltd.
If I can acquire them please let me know your conditions.
Thank you for informing me of the issue.

A day later I received an email from a different sender:

Subject: moonofalabama CN domains and internet keyword "moonofalabama"
From: Zhihai Ning <zhihaining@vip.****.com>
Date: 9/5/2022, 11:21 AM
To: MoonofA <[email protected]>

To whom it concerns,
We will register the China domain names "" "" "" "" and internet keyword "moonofalabama" and have submiƩed our applicaƟon. We are waiƟng for Mr. Albert Liu's approval. These CN domains and internet keyword are very important for us to promote our business in China. Although Mr. Albert Liu advised us to change another name, we will persist in this name.

Kind regards
Zhihai Ning

I responded to Mr. Ning, the bad guy in this game, and copied Mr. Liu, the good one. I again expressed my concern and asked Mr. Ning to use different domain names. I again offered to register those domains in my name and to keep them away from his competition.

The good guy promptly wrote back and said that he had decided to wait a few days with the domain registration to see if I wanted to purchase those names. I would need to apply for them.

I asked for an application form and prices and received those. They were quite hefty:


$140 per year for the 'internet keyword' "moonofalabama", whatever that may be, plus $38.80 per year for each of those domain names. The minimum registration period was five years!

I filled out the application form and sent it back. I then received an invoice.


A total of €1,481.80 for the registration of domain names that no one will ever use to reach this website. Plus an 'internet keyword' that most people in China will probably not even know how to spell or type.

I of course have no intention to ever pay such a bill. But others did. I know of several marketing departments which have fallen for that scam.

The trick has been known for many, many years:

For several years, Asian companies have been pressuring firms to register identical domain names in Asian Top-Level-Domains (TLDs). It is a kind of scam called “slamming”, and is an illegal practice to mislead firms in order to sell them unsolicited services.

The slamming scam always begins with an email, written in English and addressed to the CEO of the targeted company. The hustler tries to contact the manager who is often ignorant of the rules related to domain names.

They present themselves as accredited Asian registrars, mainly in China. This unknown third party notifies the firm that one of their clients wants to register domain names containing the trademark of the target of the scam.

The eager Asian "registrar" realized that the targeted firm owns the rights to the domain names in question. For “ethical” reasons, the Asian provider kindly offers to register the domain in the name of the target instead of for their “client”. The prices are often prohibitive. The greedy scammer threatens to proceed with the initial domain registration request if the rights holder does not purchase the domain names within seven to fifteen days.

About 200 mostly Chinese companies exits for solely this kind of 'business'. Shanghai YG Co., Ltd., which tried to 'slam' me, is among them.

I should probably be proud that it thought that Moon of Alabama would be a worthwhile target.

Posted by b on September 20, 2022 at 15:44 UTC | Permalink


yo B, as if there are no other urgent things to report on.

I´m quite sure you know better than all of us of the possible consequences of Donbass being part of Russia, especially with an imminent Ukrainian invasion looming on the horizon.

Posted by: Rudi Ruessel | Sep 20 2022 15:56 utc | 1

Tens of thousands take to the streets against the federal
and the media is cleverly covering it up
In Germany there were protests against the government's energy policy in numerous cities. With a remarkable trick, many major media ensure that this does not reach the consciousness of the people in this country. The possible reason: If the reports were honest and fair, many people would probably join these demonstrations. The political-media complex apparently wants to prevent this at all costs. And digs deep into the bag of tricks.

"Around 7,500 people took to the streets in 39 locations in Brandenburg on Monday evening because of the energy crisis, the Ukraine war and the Corona requirements," writes the pro-government news agency dpa. At the same time, she reports in another report: "More than 18,000 people in Thuringia took part in demonstrations against high energy costs, inflation and the war in Ukraine." high prices, the Ukraine war and the energy policy of the federal government took to the streets.” According to RND, more than 10,000 people took to the streets in Mecklenburg-Western Pomerania.
Mehr zu diesem AusgangstextFür weitere Übersetzungsinformationen ist ein Ausgangstext erforderlich
Feedback geben

Posted by: Mo3 | Sep 20 2022 15:57 utc | 2

Sorry here the link to the tens of thousands in Germany

Posted by: Mo3 | Sep 20 2022 15:59 utc | 3

Thanks for the story b

Think about what is says about the laxity, in this area, of government regulation by China. I expect if the abuse grows that China will step in with regulation but they seem to be going after the really big "low-hanging-fruit" like Ma and such that have lost a bit of social morals along the way and need to be reigned in some.

Posted by: psychohistorian | Sep 20 2022 15:59 utc | 4

not only chinse companies are working in "slaming" business, there are also some of US and other countries.
Registration if a .cn domain is cheal, just $ 7.98
Maybe it is not a faialure, to register some for protection against fraud and fake linkings.

Posted by: peter | Sep 20 2022 16:05 utc | 5

This seems to be a far off topic Russia/Ukraine discussion...
Sorry....then I'm out, technical meaningless discussions are not my medium, there are enough of them on the web

Posted by: Mo3 | Sep 20 2022 16:10 utc | 6

In response to
This seems to be a far off topic Russia/Ukraine discussion...
Sorry....then I'm out, technical meaningless discussions are not my medium, there are enough of them on the web

Posted by: Mo3 | Sep 20 2022 16:10 utc | 6


The trolls are butt hurt by your posting b...LOL!!! ought to bring back the one about toilet paper....grin

Posted by: psychohistorian | Sep 20 2022 16:14 utc | 7

It's a scam, which they're presumably sending out to thousands of domains, regardless of size. I received the same email about my website, which gets maybe 5% of the traffic as Moon of Alabama.

Posted by: Ian Kummer | Sep 20 2022 16:16 utc | 8

Dear B., don't take it personally. I received an identical letter last week. I didn't answer it because I don't need a separate domain name in China, already having one in the West. It seems that they had a very large list of just about anyone with a domain name (such as my own,
I suspect that many readers of your blog got similar messages.

Posted by: Michael Hudson | Sep 20 2022 16:23 utc | 9

Think about what is says about the laxity, in this area, of government regulation by China. I expect if the abuse grows that China will step in with regulation but they seem to be going after the really big "low-hanging-fruit" like Ma and such that have lost a bit of social morals along the way and need to be reigned in some.

The problem is that even if this is technically a "crime" in some countries, it's probably next to impossible to prosecute. Selling domain names to people isn't illegal and there's no victim. If someone willingly buys up a bunch of adjacent domain names, what exactly is the complaint? That he's really gullible?

Posted by: Ian Kummer | Sep 20 2022 16:25 utc | 10

reminds me of this. . .

China’s Changing Disinformation and Propaganda Targeting Taiwan

Since early August, evidence has emerged of a new type of CCP influence operation that sharply diverges away from traditional messaging and tactics.
The new campaign style appears to adopt a two-stage process, the first of which involves uploading video content onto Google-owned platforms such as YouTube through fake accounts with generic or gibberish names.
The second stage of this process involves circulating links to these YouTube videos on non-Google platforms such as Reddit – a news aggregation and discussion website consisting of subreddits, communities that revolve around a particular topic or theme. . . .here

Posted by: Don Bacon | Sep 20 2022 16:27 utc | 11

LOL. The creeps pick a wrong target this time. Well done, b.

Posted by: Steve | Sep 20 2022 16:27 utc | 12

It is not as if a coherent discussion about events in the Ukraine can conducted with the massive troll onslaught anyway, so it is worth a try to change the subject and see if some of those trolls get reassigned back to Twitter.

As an aside, the one valuable data point the troll armies supply is that things are not going well for the empire. The trolls are not being hired out of oligarch generosity, after all. The fact that the trolls are here means the empire feels it needs spin control, which wouldn't be necessary if they were winning.

Posted by: William Gruff | Sep 20 2022 16:29 utc | 13

Posted by: psychohistorian | Sep 20 2022 16:14 utc | 7
What does that have to do with trolls?
I'm here to get information about what's happening because I can hardly find any other sources in Germany or can't find any at all!
You troll!

Posted by: Mo3 | Sep 20 2022 16:34 utc | 14

as always, thanks for all your efforts b. sorry you're being targeted like this but i guess it goes with the territory, hosting such an awesome site!

Posted by: annie | Sep 20 2022 16:36 utc | 15

also funny because you can probably register those through any "godaddy" type company - though for "real" registration (whatever that means) you apparently need chinese docs.

which is another sign (if you needed one) that this is a scam. you got the ".com" which is the real annoyance when it comes to parking and faking.

Posted by: the pair | Sep 20 2022 16:38 utc | 16

Rudi #1, check the home page, and show a tad respect!

Posted by: annie | Sep 20 2022 16:38 utc | 17

I'm still waiting on my money from Nigeria.

Posted by: gottlieb | Sep 20 2022 16:39 utc | 18

@ Mo3 | Sep 20 2022 16:34 utc | 14 who seems to think it is ok to bust into a bar, spout out all sorts of gibberish without ever taking time to listen/read for a few months

And then tell the barkeep what he should be serving at the bar...don't let the door hit you in the ass on your way out

Posted by: psychohistorian | Sep 20 2022 16:42 utc | 19

This practice is just a second level variant of domain parking.
The correct answer is: DGAF
Works mostly on stupid businesses with delusions of grandeur.

Posted by: c1ue | Sep 20 2022 16:44 utc | 20

Posted by: Michael Hudson | Sep 20 2022 16:23 utc | 9

The most important take away message from this thread is that the actual Michael Hudson reads MoA!

Posted by: alek_a | Sep 20 2022 16:46 utc | 21

Yes, the Chinese have learnt well from their Western peers. Still, a long way to go to catch-up in the Ponzi Arena.

Posted by: WTFUD | Sep 20 2022 16:50 utc | 22


Posted by: sln2002 | Sep 20 2022 16:51 utc | 23

alek @21

That impressed me too!

Posted by: wagelaborer | Sep 20 2022 16:55 utc | 24

Oh, I get it. Chinese bad. F that.

Posted by: Jimmy Flies By | Sep 20 2022 17:00 utc | 25

Hello Bernhard, I suggest to consider the action "moonofalabama.CN" as a warning shot. Your article about the Ukrainian cemetery has REUTERS led to withdraw its own article on this subject (if REUTERS furthermore wants be considered a 'professional' new agency). So I guess some people in the background decided that your blog is 'disturbing'. They won't tell you that directly (because these people are cowards and want to make themselves comfortable), but they use some stooges to do it. Even Chinese are good enough for such a task. This is the way the whole US history has been going on for 260 years: incite riots, wage wars, make money.

The underground agitators of the 1760s, who orchestrated the "color revolution" in the colonies at that time, such as John Hancock or John & Samuel Adams, later became "presidents" and have since been considered honorable Founding Fathers ...

Thank you for your work - watch out & take care!


Posted by: gerhard | Sep 20 2022 17:05 utc | 26

Here's a This American Life segment about some people who run elaborate cons on internet scammers.

Posted by: David Levin | Sep 20 2022 17:59 utc | 27

As some of this pertains to mainland China, being "an old China hand", may I be allowed to add some comments?:
1: The Chinese State or the Communist Party do-not interfere a lot with what China-based net-sites do engaging in in the outside world.
2: These kinds of scams-- as described in this article -- some 10-30 years ago used to come out of The Ukraine. Have perforce some of these adept scabs now ended up and resettled in Mainland China, parfois?
3: Scams is a national Chinese character defect -- but all scammers usually let one some way out. Ukrainans not of You got caught by then -- and then they would invade one's computers.
4: In my years, Chinese authorities would follow up un computer trolling and at times prosecute even. DON'T KNOW ABOUT NOW.
5: I'm confident authorities in China will catch up with and correct this problem. Possibly through some of the four (4) "social responsibly registers" that are now in use and which are open-access for those registred in them.

Posted by: Tollef Ås/秋涛乐/טלפ וש | Sep 20 2022 18:00 utc | 28

@ Mo3

The generation "free of charge" actually thinks, they have a "claim" or a "right" ... free of charge, of course ...

Posted by: Humml | Sep 20 2022 18:14 utc | 29

Don't be proud that they thought Moon of Alabama is important. I am a nobody and own a company where I am the only employee and I have received two of these attempts over the last eight years of being in business. Since they are Chinese and believe in the concept of karma, I only replied once, basically taunting them and telling them to go ahead - but that their behavior would impact their karma.

Posted by: iosokin | Sep 20 2022 18:24 utc | 30

If the email had come from Ukraine it would be a wife being dangled on the hook instead of web domains...

Posted by: Patroklos | Sep 20 2022 18:39 utc | 31

When the Patriot Act was passed, none of our no congressmember had read it. The current massive propaganda/censorship machine is not aimed average citizens. Its purpose is continued war funding and the targeted audience is the lazy misinformed congress members who write the checks under the cover of plausible deniability.

Posted by: Willow | Sep 20 2022 19:43 utc | 32

"If the LNR and DPR vote to become part of Russia, and if Russia accepts it, any attack of them will be an act of war against Russia"

I'm a little confused. So for the past 6 months, all the missile attacks, artillery strikes, sabotage and drone attacks, helicopter and air force attacks, whole ammunition dumps and oil depots gone up in smoke.... This has all happened in Kursk, Belgorod, Crimea and Briansk oblasts pretty regularly for over 6 months now. And let's not forget, a high profile bombing in Moscow....

So why does Putin need to wait for a referendum to "start something", when Russians in Russia proper have been under attack since March??

Besides, how can Russia expect to make a legitimate claim on Donetsk, when it doesn't even control half of it militarily, despite trying to take it for over 6 months now?

Posted by: Et Tu | Sep 20 2022 19:56 utc | 33

To b and any other non-Chinese spreaking readers and commentators, here is the List of Overseas Registrars offically aprroved by China Internet Network Information Center (CNNIC).

Neither "China Registry" nor Shanghai YG Co, Ltd (name on the billing sent to b) is on the list.

I also did a serach under "Record Agency Search" on CNNIC's website, not in the record, Shanghai YG Co, Ltd not in the record

Searching about this so-called "China Registry" and Shanghai YG Co, Ltd on the biggest Chinese seach engine Baidu, you'd found a typical scam company:

1. NO Chinese on its official website, normally any website ending with .cn should have Chinese on the opening page on its offical site. It does not have any Chinese nor any language choice button except just English.

2. My serach results show there are many Chinese complain this same "China Registry" company trying to scam Chinese companies as well by using the exactly same wording emails: here and here.

Unfortunately I could find any information who are behind this scam company, but, by accidnet, find out now IP is from Hong Kong.

(Btw, some Taiwanese used to do all sorts of online and telephone scams and frauds towards Mainland Chinese, just like some Ukrainians did/do towards Russians. )

Posted by: lulu | Sep 20 2022 20:03 utc | 34

Re: Slamming MoA.

I wasn't aware that China has adopted the Yankee convention for expressing dates. If I received a message expressing September 3, 2022 as 9/3/2022 I would assume that the author was AmeriKKKan - regardless of the PERCEIVED geographical location of the sender.

Posted by: Hoarsewhisperer | Sep 20 2022 20:09 utc | 35

Posted by: Ian Kummer | Sep 20 2022 16:16 utc | 8

It's a scam, which they're presumably sending out to thousands of domains, regardless of size. I received the same email about my website, which gets maybe 5% of the traffic as Moon of Alabama
I own an engineering company with very specific and narrow customer base which use "Approved Supplier List". Yet, a few years back I have received almost identical mail as b.
I did not bother answering.

Posted by: Vajezatha | Sep 20 2022 20:37 utc | 36

That is normall scam. Many many domain names receive such emails every now and then.The best way is do not reply them. They do the same trick again and again with different configuration like etc.

Posted by: Arata | Sep 20 2022 21:02 utc | 37

Yes, this is an old trick. I've played along with it a few times.

Posted by: Tom_Q_Collins | Sep 20 2022 22:16 utc | 38

Our family firm has maintained a presence in China since 2007, we have had dozens of such emails, all ignored, they seem to have tapered off lately but something new emerged just last week. Someone has applied to have our trademark deregistered. I seems we have had to appoint a lawyer to defend it.

If anyone is interested in the outcome I'll report back on the open thread in due course.

Posted by: Walt | Sep 20 2022 23:26 utc | 39

If anyone is interested in the outcome I'll report back on the open thread in due course.

Posted by: Walt | Sep 20 2022 23:26 utc | 39

Yes, please do. Thanks.

Posted by: David Levin | Sep 21 2022 0:12 utc | 40

Michael Hudson | Sep 20 2022 16:23 utc | 9
Whoa! Maybe b’s bar/blog IS famous.
alek_a | Sep 20 2022 16:46 utc | 21
wagelaborer | Sep 20 2022 16:55 utc | 24

Mo3 | Sep 20 2022 16:34 utc | 14
Rude. Ungracious.
psychohistorian | Sep 20 2022 16:42 utc | 19
Yep. Well said.

Posted by: Melaleuca | Sep 21 2022 0:13 utc | 41

Lulu @ 34:

Thanks Lulu, that is intriguing and valuable information you have dug up. Your post really should be highlighted at the top of the comments forum. Thanks for your time and effort in doing this.

On reading MoA's original post, I had thought this scammer would be someone or some organisation based in either Hongkong or Taiwan. The timing of the scam seemed suspicious to me.

I would not be at all surprised if the scam had originated in Taiwan in response to recent MoA posts about Russia's SMO in Ukraine, given that after 1949, former OUN leaders like Yaroslav Stetsko worked with Jiang Jieshi (Chiang Kaishek) in setting up ultra-right organisations like the World Anti-Communist League and others purporting to be anti-Communism crusaders.

Posted by: Jen | Sep 21 2022 0:46 utc | 42

Good smell. American egos often fall for fake acknowledgment of their successes
I upvote for integrity

Posted by: Bill Venable | Sep 21 2022 1:01 utc | 43

That "China domain name registration center" email you received is a standard scam that's been running on the Internet for years. I've received one of these for all the (totally insignificant, zero-traffic) domain names that I own.

I suspect it's probably quite a successful scam though. Because they're selling (at a much higher price), legitimate Chinese public suffix versions of the "" domain.

If any domain hasn't received one yet, it's only because their spamming software hasn't got
around to it yet.

Posted by: Joe Bloggs | Sep 21 2022 1:07 utc | 44

I expect the announcement will be a new red line to the effect of something like this:

Russia will consider any further attacks on the Zapo Nuclear Plant or similar targets, as nuclear attacks on Russia itself by NATO. Any retaliation will be directed at NATO decision making centers, in addition to Kiev and Lvov.

Posted by: Rhinoskerous | Sep 21 2022 1:26 utc | 45

I wonder if moonoftaiwan or moonofformosa is still available.

Posted by: morongobill | Sep 21 2022 2:11 utc | 46

Just China being awesome, again!
Let’s hear it for China!
Hip hip, hooray!

Posted by: Cadence calls | Sep 21 2022 4:37 utc | 47

People scam in China. Foreigners are particularly common targets. In two different jobs there I had money disappear from my Chinese bank account, and I only suspect my employers, who said some unusual things. In general, Chinese are extremely kind and honest. But there are scammers in every type of situation you can imagine and some you wouldn't think of. In general I felt safer there than I do in the US. But I can't go back. I am too old for the work visa anymore and they don't want tourists right now.

Posted by: HelenB | Sep 21 2022 6:09 utc | 48

"I should probably be proud that it thought that Moon of Alabama would be a worthwhile target. "

Nothing in the exchange shows any sign that it's NOT being fully automated and used on very large scales. Sorry b!

Posted by: John Dowser | Sep 21 2022 7:44 utc | 49

Western press is quite agitated about the possibility of convicts joining the army in return for a reduction in sentence.
What do they think the French Foreign Legion is?

Posted by: Passerby | Sep 21 2022 7:52 utc | 50



Posted by: Jonathan Holland Bec | Sep 21 2022 9:37 utc | 51

Thanks b for sharing the fun!

On scams I recently started watching and enjoying the Korean fiction series called "38 Task Force" which is about a tax collector using scam artists to collect unpaid taxes from the wealthy and corrupt and so on. Very good so far but also "very Korean" (to me that's good but to others maybe not) :)

· · ·

Joe Bloggs, I disagree about the word "legitimate" in the following:

"I suspect it's probably quite a successful scam though. Because they're selling (at a much higher price), legitimate Chinese public suffix versions of the "" domain."
Here's what gandi dot net says about conditions for .cn domains:
The registration, transfer or ownership change of a .CN requires the provision of documentary evidence:
- For an organization out of China: a copy of your organization registration certificate with an official body, only official registration bodies with an database accessible online are be accepted by the Registry.
- For a Chinese organization: copy of the business registration certificate.
- For an individual out of China: a copy of your passport.
- For a Chinese individual: a copy of your Chinese national ID card or residence permit.
In all cases, the organization or individual name as specified in your Gandi account must match exactly with the name listed on the organization/business certificate or ID document provided.
Your domain name will be suspended if the Registry cannot validate your data within 5 days of the registration, transfer or ownership change of the domain name.
In addition from January 1st, 2022, holders whose data has not been validated by the Registry will no longer be able to renew, transfer and change the holder of their domain name.
So if they had actually bought anything (they wouldn't unless there are further levels to the scam) they would have to register it with their information in China and it would never be yours.

And if they had actually bought it for you (they wouldn't unless there are further levels to the scam) they would need a copy of your information (which they didn't ask for, yet).

Anyway I apologize if I'm nitpicking too much. I was only curious and found out right now (I never thought about .cn domains before).

· · ·

Back to b's "benefactors": messing about on gandi dot net I found this little gem, very overpriced (renewal is likely 3× the cost) and sadly one has to be woke or lose it: (premium) view conditions € 2,656.22 /year

LOL :D (who buys it? Well no one so far obviously and I'm not going to either).

In my defense I was searching for 'beyond dot something else' and was shocked at some of the prices before this one made me laugh.

Posted by: Sunny Runny Burger | Sep 21 2022 12:11 utc | 52

sure are a lot of these type scams coming out of china... as optimistic as i'd like to be about china, this is one example of a messy situation china needs to address...

great work as always b... you were insightful enough to know you were being conned.. that's good!

Posted by: james | Sep 21 2022 20:36 utc | 53

"sure, are a lot of these type scams coming out of China... as optimistic as i'd like to be about China, this is one example of a messy situation China needs to address..."

Posted by: james | Sep 21 2022 20:36 utc | 53

What would you expect from China. The US wants to go to war with them, the EU countries seem to be in agreement as they shuffle behind Biden with their nose up his arse. The total breakdown of respectful relations with China and the west, which includes policing and investigating fraud and cyber swindles is the least important thing that the Chinese government is concerned about these days, I am sure that WW3 takes precedence.

Posted by: Guernica | Sep 21 2022 20:54 utc | 54

I don't know the process for registering .cn TLDs, but TLDs for Brazil, (,, etc.) can only be registered using, though I think there may be some companies that will register .br TLDs through for clients. The current price is BR$40/year (about US$8) You might want to consider registering those domains through whatever the legitimate channels are. The legitimate price might be considerably less. But then, I realize "Why bother?" is a legitimate question/option. Registering your domain name in all of the TLDs around the world would be quite expensive.

Posted by: Randall Paul Allen | Sep 25 2022 14:02 utc | 55

Lol sino phobia much? Reds under the bed time! Gunna get you by your short and curlies! Sorry scamming is a global phenomena kids, don’t forget to cover your racist bald patch your toupee slipped.

Posted by: The Anglo Sino | Sep 26 2022 12:23 utc | 56

The comments to this entry are closed.