{"success":true,"data":{"id":"japanese-delivery-redelivery-yamato-sagawa-phish","label":"Japanese-language delivery phishing — #1 Japanese phishing pattern by volume. Impersonates Yamato Transport (ヤマト / クロネコ / 黒猫), Sagawa Express (佐川急便), Japan Post (日本郵便 / ゆうパック), or Amazon.co.jp with \"ご不在\" / \"再配達\" / \"配達できませんでした\" phrasing + URL to a credential-harvesting redelivery form. Proofpoint + BleepingComputer: CoGUI kit sent 580M+ such emails early 2025; DarkReading + The Record + Yamato Holdings official scam alerts. Opens Japanese regional coverage; distinct from English delivery-phish signals","description":"Japanese-language phishing email claiming a delivery attempt failed, impersonating Yamato Transport (ヤマト運輸 / クロネコヤマト / 黒猫 / クロネコ / kuronekoyamato), Sagawa Express (佐川急便 / 佐川), Japan Post (日本郵便 / JP POST / ゆうパック), or Amazon.co.jp delivery. Body uses characteristic Japanese phrasing — \"お荷物をお届けできませんでした,\" \"ご不在のためお持ち帰り,\" \"再配達のご依頼,\" \"配達できませんでした\" — and pushes a URL to a fake redelivery-scheduling form that harvests login credentials and payment details. This is the single highest-volume Japanese phishing pattern: the CoGUI phishing-kit operation sent 580 million+ of these emails in early 2025 (Proofpoint + BleepingComputer). DarkReading, The Record, and Yamato Holdings have all issued advisories. Distinct from Western delivery-failure phishing because the regex is Japanese-language-specific and the carrier brands differ (Yamato + Sagawa + Japan Post dominate the Japanese last-mile market the way FedEx / UPS / USPS do in the US). Opens the engine's Japanese-language regional coverage (no prior Japanese-specific signals existed). Warning signs: any email in Japanese claiming a delivery failure from a domain that is not the real yamato-hd.co.jp / sagawa-exp.co.jp / post.japanpost.jp / amazon.co.jp, and any \"再配達\" link that does not point at the real carrier site.","tier":"danger","category":"phishing","isThin":false}}