## Overview

On February 21, 2026, Brad Duncan at the SANS Internet Storm Center published analysis of a coordinated Japanese-language phishing campaign that impersonates multiple major brands including ANA (All Nippon Airways), DHL Express, and myTOKYOGAS (Tokyo Gas utility service). The campaign has been active for at least one year, targeting Japanese-speaking users with credential-harvesting emails and phishing pages.

## Infrastructure Analysis

### Sending Infrastructure

All three documented phishing emails originate from Hong Kong-based infrastructure on AS150436, operated by Byteplus Pte. Ltd. (a subsidiary of ByteDance, the parent company of TikTok). The three sending IPs — 150.5.129.136, 101.47.78.193, and 150.5.130.42 — all geolocate to the Yau Tsim Mong District of Hong Kong and share the same ASN. This indicates the campaign operator is renting cloud infrastructure from Byteplus to send phishing emails, leveraging the platform's reputation to bypass email filtering.

The sending domains are randomly generated .cn domains: - ncqjw.cn (sending ANA phish) - obpwnrl.cn (sending DHL phish) - cwqfvzp.cn (sending myTOKYOGAS phish)

These domains follow a pattern of short, random-character .cn registrations — a hallmark of Chinese-origin phishing infrastructure designed for disposability. Each domain is used briefly before being burned and replaced.

### Foxmail X-Mailer Fingerprint

The most significant attribution indicator is the consistent X-Mailer header across all samples: 'Foxmail 6, 13, 102, 15 [cn]'. Foxmail is a freeware email client developed by Tencent Holdings, with dominant market share in China. Version 6.x is a legacy release — the current version is 7.2.25 (September 2022). The use of this specific legacy version across all campaign emails confirms:

1. A single operator or coordinated group using the same email sending toolkit 2. Chinese-origin operation (Foxmail is predominantly used in China) 3. The [cn] locale tag confirms Chinese-language Foxmail installation 4. Legacy version suggests either an older automated sending setup or deliberate version pinning for compatibility with bulk-sending scripts

### Phishing Page Infrastructure

Phishing pages are hosted on .cn domains with randomized subdomain prefixes: - branchiish.aayjlc.cn/amcmembr_Loginam/ (ANA credential harvest) - decideosity.ykdyrkye.cn/portal_login_exp/getQuoteTab/ (DHL credential harvest) - impactish.rexqm.cn/mtgalogin/ (myTOKYOGAS credential harvest)

The URL path patterns are customized per brand but follow a consistent structure: randomized English-sounding subdomain + short random .cn domain + brand-specific path mimicking legitimate login endpoints.

## Brand Impersonation Analysis

### ANA (All Nippon Airways) Japan's largest airline by revenue. The phishing email impersonates ANA communications, likely targeting ANA Mileage Club members with messages about account verification, mileage expiration, or booking confirmations. The credential-harvesting page mimics ANA's AMC member login portal.

### DHL Express Global logistics and shipping company with significant operations in Japan. DHL phishing typically uses delivery notification lures — package tracking, customs clearance, or delivery scheduling. The URL path 'portal_login_exp/getQuoteTab/' suggests a shipping portal impersonation.

### myTOKYOGAS Tokyo Gas utility service portal. Targets Japanese residents who use Tokyo Gas for home energy. Phishing lure likely involves billing, account verification, or payment update notifications. The path 'mtgalogin/' directly references the myTOKYOGAS login abbreviation.

## Campaign Characteristics

### Scale and Distribution The campaign uses bulk distribution reaching non-Japanese speakers, as documented by the SANS researcher who received multiple phishing emails despite not being Japanese. This indicates: - Large email lists purchased or scraped without language filtering - High-volume, low-precision approach (spray and pray) - Willingness to burn sending domains quickly due to spam filter catches

### Operational Consistency Despite impersonating different brands, all emails share: - .cn sending domains (randomly generated) - .cn phishing page domains (randomly generated with English-sounding subdomains) - Identical X-Mailer: Foxmail 6, 13, 102, 15 [cn] - Same ASN (AS150436) for sending infrastructure - +0800 timezone in Date headers (UTC+8, consistent with China/Hong Kong) - Japanese language content with brand-specific lures

### Attribution Assessment The campaign is attributed with MEDIUM confidence to a Chinese-speaking threat group based on: - Foxmail Chinese-language client with [cn] locale - All infrastructure on .cn TLD - Sending IPs in Hong Kong (Byteplus/ByteDance cloud) - +0800 timezone in email headers - Operational pattern consistent with Chinese phishing-as-a-service ecosystems

The motivation is FINANCIAL — credential harvesting for ANA loyalty accounts (mileage fraud), DHL shipping accounts (logistics fraud), and utility accounts (payment card theft).

## Defensive Recommendations

### Immediate Actions - Block sending IPs: 150.5.129.136, 101.47.78.193, 150.5.130.42 at email gateway - Block .cn TLD in email sending domains for organizations not doing business with Chinese entities - Add X-Mailer 'Foxmail 6, 13, 102, 15' to email header-based detection rules - Block phishing domains: aayjlc.cn, ykdyrkye.cn, rexqm.cn, ncqjw.cn, obpwnrl.cn, cwqfvzp.cn

### Long-Term Defenses - Implement DMARC enforcement for impersonated brands (ANA, DHL, TOKYOGAS) - Deploy email gateway rules matching .cn TLD + Foxmail X-Mailer combination - User awareness training for Japanese-language phishing indicators - Monitor for new .cn domain registrations matching random-character patterns - Implement certificate transparency monitoring for brand domains

### Detection Opportunities - Email header analysis: X-Mailer fingerprint matching across diverse brand lures - URL pattern analysis: randomized English subdomain + short .cn domain + brand-specific path - Timezone analysis: +0800 offset in Date headers from non-Chinese-branded senders - ASN correlation: multiple phishing campaigns from AS150436 (Byteplus)