Japanese-language delivery phishing — #1 Japanese phishing pattern by volume. Impersonates Yamato Transport (ヤマト / クロネコ / 黒猫), Sagawa Express (佐川急便), Japan Post (日本郵便 / ゆうパック), or Amazon.co.jp with "ご不在" / "再配達" / "配達できませんでした" phrasing + URL to a credential-harvesting redelivery form. Proofpoint + BleepingComputer: CoGUI kit sent 580M+ such emails early 2025; DarkReading + The Record + Yamato Holdings official scam alerts. Opens Japanese regional coverage; distinct from English delivery-phish signals
japanese-delivery-redelivery-yamato-sagawa-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Japanese-language phishing email claiming a delivery attempt failed, impersonating Yamato Transport (ヤマト運輸 / クロネコヤマト / 黒猫 / クロネコ / kuronekoyamato), Sagawa Express (佐川急便 / 佐川), Japan Post (日本郵便 / JP POST / ゆうパック), or Amazon.co.jp delivery. Body uses characteristic Japanese phrasing — "お荷物をお届けできませんでした," "ご不在のためお持ち帰り," "再配達のご依頼," "配達できませんでした" — and pushes a URL to a fake redelivery-scheduling form that harvests login credentials and payment details. This is the single highest-volume Japanese phishing pattern: the CoGUI phishing-kit operation sent 580 million+ of these emails in early 2025 (Proofpoint + BleepingComputer). DarkReading, The Record, and Yamato Holdings have all issued advisories. Distinct from Western delivery-failure phishing because the regex is Japanese-language-specific and the carrier brands differ (Yamato + Sagawa + Japan Post dominate the Japanese last-mile market the way FedEx / UPS / USPS do in the US). Opens the engine's Japanese-language regional coverage (no prior Japanese-specific signals existed). Warning signs: any email in Japanese claiming a delivery failure from a domain that is not the real yamato-hd.co.jp / sagawa-exp.co.jp / post.japanpost.jp / amazon.co.jp, and any "再配達" link that does not point at the real carrier site.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started