{"id":1463,"date":"2026-02-21T07:04:34","date_gmt":"2026-02-21T07:04:34","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/21\/japanese-language-phishing-emails-sat-feb-21st\/"},"modified":"2026-02-21T07:04:34","modified_gmt":"2026-02-21T07:04:34","slug":"japanese-language-phishing-emails-sat-feb-21st","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/21\/japanese-language-phishing-emails-sat-feb-21st\/","title":{"rendered":"Japanese-Language Phishing Emails, (Sat, Feb 21st)"},"content":{"rendered":"
\n

Introduction<\/strong><\/em><\/p>\n

For at least the past year or so, I’ve been receiving Japanese-language phishing emails to my blog email addresses at @malware-traffic-analysis.net.\u00a0 I’m not Japanese, but I suppose my blog’s email addresses ended up on a list used by the group sending these emails. They’re all easily caught by my spam filters, so they’re not especially dangerous in my situation. However, they could be effective for the Japanese-speaking recipients with poor spam filtering.<\/p>\n

Despite the different companies impersonated, they all follow a similar pattern for the phishing page URLs and email-sending addresses.<\/p>\n

This diary reviews three examples of these phishing emails.<\/p>\n

\"\"<\/a>
\nShown above: The spam folder for my blog’s admin email account.<\/em><\/p>\n

Screenshots<\/strong><\/em><\/p>\n

The first screenshot shows an example of a phishing email impersonating the Japanese airline ANA (All Nippon Airways). Both the sending email address and the link for the phishing page use domains with a .cn<\/span>\u00a0top-level domain (TLD).<\/p>\n

\"\"<\/a>
\nShown above: Example of a Japanese phishing email impersonating ANA.<\/em><\/p>\n

The second screenshot shows an example of a phishing email impersonating the shipping\/logistics company DHL. Like the previous example, both the sending email address and the link for the phishing page use domains with a .cn<\/span>\u00a0top-level domain (TLD).<\/p>\n

\"\"<\/a>
\nShown above: Example of a Japanese phishing email impersonating DHL.<\/em><\/p>\n

Finally, the third screenshot shows an example of a phishing email impersonating the utilities company myTOKYOGAS. Like the previous two examples, both the sending email address and the link for the phishing page use domains with a .cn<\/span>\u00a0top-level domain (TLD).<\/p>\n

\"\"<\/a>
\nShown above: Example of a Japanese phishing email impersonating myTOKYOGAS.<\/em><\/p>\n

As noted earlier, these emails have different themes, but they have similar patterns that indicate these were sent from the same group.<\/p>\n

Indicators of the Activity<\/strong><\/em><\/p>\n

Example 1:<\/p>\n