Japanese-Language Phishing Emails, (Sat, Feb 21st)

This report documents a series of Japanese-language phishing emails observed over ~1 year that impersonate companies (ANA, DHL, myTOKYOGAS) and use .cn domains and Foxmail-sourced email headers; the author provides sample headers, sender addresses, IPs and phishing URLs and notes these shared patterns likely indicate a single group conducting a wide-net credential-phishing campaign.