Japanese-language delivery phishing — #1 Japanese phishing pattern by volume. Impersonates Yamato Transport (ヤマト / クロネコ / 黒猫), Sagawa Express (佐川急便), Japan Post (日本郵便 / ゆうパック), or Amazon.co.jp with "ご不在" / "再配達" / "配達できませんでした" phrasing + URL to a credential-harvesting redelivery form. Proofpoint + BleepingComputer: CoGUI kit sent 580M+ such emails early 2025; DarkReading + The Record + Yamato Holdings official scam alerts. Opens Japanese regional coverage; distinct from English delivery-phish signals

Japanese-language phishing email claiming a delivery attempt failed, impersonating Yamato Transport (ヤマト運輸 / クロネコヤマト / 黒猫 / クロネコ / kuronekoyamato), Sagawa Express (佐川急便 / 佐川), Japan Post (日本郵便 / JP POST / ゆうパック), or Amazon.co.jp delivery. Body uses characteristic Japanese phrasing — "お荷物をお届けできませんでした," "ご不在のためお持ち帰り," "再配達のご依頼," "配達できませんでした" — and pushes a URL to a fake redelivery-scheduling form that harvests login credentials and payment details. This is the single highest-volume Japanese phishing pattern: the CoGUI phishing-kit operation sent 580 million+ of these emails in early 2025 (Proofpoint + BleepingComputer). DarkReading, The Record, and Yamato Holdings have all issued advisories. Distinct from Western delivery-failure phishing because the regex is Japanese-language-specific and the carrier brands differ (Yamato + Sagawa + Japan Post dominate the Japanese last-mile market the way FedEx / UPS / USPS do in the US). Opens the engine's Japanese-language regional coverage (no prior Japanese-specific signals existed). Warning signs: any email in Japanese claiming a delivery failure from a domain that is not the real yamato-hd.co.jp / sagawa-exp.co.jp / post.japanpost.jp / amazon.co.jp, and any "再配達" link that does not point at the real carrier site.