# Bad Sushi: China-Nexus Phishing Operation Shifts to Residential Proxy Networks

> A China-nexus phishing operation ('Bad Sushi') abandoned its dedicated China Telecom/China Unicom spam-sending subnets in April 2025 for rented residential-proxy infrastructure, jumping from single-country (Japan) targeting to 173 countries and 1.3M+ distinct source IPs within a month while impersonating Japanese financial brands SBI, JCB, and Hodaka.

- **Published:** 2026-09-12T00:00:00Z
- **Last reviewed:** 2026-09-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2471
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-bad-sushi-residential-proxy-phishing-tl-2026-2471.webp?v=58869b9c (Threadlinqs threat intel: Bad Sushi China-Nexus Phishing: Detection & IOCs (TL-2026-2471) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2471
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

Since at least February 2023, Spamhaus has tracked a China-nexus phishing operation running dedicated spam cannons out of China Telecom (Fujian branch) and China Unicom subnets, primarily targeting Japanese internet users with phishing emails impersonating financial brands SBI, JCB, and Hodaka. Listing of those subnets in the Spamhaus Blocklist (SBL) suppressed deliverability, and in early April 2025 the operator pivoted its sending infrastructure to residential proxy networks built on insecure or pre-compromised consumer/IoT devices (the same abuse model documented in Spamhaus's earlier reporting on malicious proxy SDKs bundled with apps such as Mobdro and on compromised smart doorbells).

The pivot produced an immediate and dramatic scale increase: within the same month the operation was observed churning 3.5-4 million residential-proxy IPs at a rate of roughly 250,000 IPs per day, with Spamhaus noting that source-IP geography (Latin America in particular) 'lit up in Spamhaus's systems like a Christmas tree.' By May 2025 the campaign's source geography had expanded from a single country to 173 countries, with distinct source IPs growing from approximately 4,600 to over 1.3 million spread across 8,893 distinct Autonomous Systems. Alongside the infrastructure shift, the operator changed its email tradecraft: pre-shift messages used brand-impersonating HELO strings tied to the targeted financial institutions, while post-shift traffic consistently uses generic, non-existent HELOs — a reliable discriminator for defenders. Spamhaus additionally observed the operator (and adjacent spam senders) routing messages through legitimate email-forwarding services to 'wash' phishing mail and inherit better sender reputation for deliverability. Phishing landing pages moved from shared file-hosting networks to dedicated VPS instances on Alibaba Cloud and Tencent Cloud, fronted by .top-TLD redirector domains.

The operation demonstrates active, systematic evasion: proxy IPs are discarded within minutes of being added to Spamhaus datasets, and emissions have begun shifting from IPv4 to IPv6 address space, driving a corresponding surge in IPv6 listings. As of the October 2025 Spamhaus report, residential-proxy activity attributable to this and related campaigns accounted for roughly 66% of all Exploits Blocklist (XBL) listings (3.34 million) and 37% of Combined Spam Sources (CSS) listings (1.73 million). Spamhaus separately observed a similar Brazil-nexus campaign abusing ~500,000 residential-proxy IPs for brute-force login attempts in the weeks preceding the China-nexus pivot, and noted comparable phishing activity against Taiwanese internet users, suggesting a broader trend of China-nexus and adjacent actors adopting rented residential-proxy infrastructure as a blocklist-evasion primitive. Bitsight traces the underlying malware lineage to 'backconnect' residential-proxy malware active since at least 2016.

No specific actor group or malware family is named by Spamhaus for this operation; the 'Bad Sushi' designation is the vendor's campaign label, not a confirmed threat-actor identity. The residential-proxy pools abused for delivery are themselves built and monetized by a distinct criminal ecosystem that Spamhaus, Bitsight, and Google's Threat Intelligence Group (GTIG) have separately documented as the supply chain enabling this and comparable phishing/fraud campaigns. GTIG's January 2026 disruption of the IPIDEA conglomerate (operating 13 proxy/VPN storefront brands including Luna Proxy, 922 Proxy, ABC Proxy, and IPIDEA itself, all signed with Hong Kong shell-company code-signing certificates) found over 550 distinct threat groups — including China-, DPRK-, Iran-, and Russia-nexus clusters — using IPIDEA exit nodes in a single 7-day window for SaaS access, on-premises intrusions, and password-spray attacks, backed by roughly 7,400 Tier Two C2 servers, 3,075 malicious Windows PE hashes, and 600+ compromised Android apps (PacketSDK, CastarSDK, HexSDK, EarnSDK — the last a rebrand of prior Badbox 2.0 botnet infrastructure); Google, Cloudflare, and Lumen/Black Lotus Labs jointly disrupted the Tier One C2 domains and Google Play Protect blocked the malicious SDK-bearing apps. GTIG's July 2026 follow-up disruption of the separate NetNut platform (built on the ~2-million-device Popa botnet, seized with FBI and IRS-CI involvement) found 316 distinct threat clusters using suspected NetNut exit nodes in a single week and identified NetNut botnet-plugin components shared with Badbox 2.0 — evidence that the same underlying device-compromise supply chain feeds multiple competing residential-proxy storefronts. Those entities are recorded here as sourced infrastructure context establishing the delivery mechanism's provenance, not as confirmed operators of the Bad Sushi campaign itself.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.005 Botnet
- T1585.002 Email Accounts
- T1585.003 Cloud Accounts
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1665 Hide Infrastructure
- T1090.002 External Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Residential-Proxy Tier-One C2 Beacon — IPIDEA/NetNut SDK Callback (SPL)** (`TL-2026-2471-SPL-003`)

Detects outbound DNS/HTTP(S) callbacks from managed endpoints, mobile devices, or IoT/edge devices to known IPIDEA/NetNut Tier One C2 domains (packetsdk.xyz/.net/.io, holadns.com, dispatch1.hexsdk.com) or previously observed residential-proxy exit-node IPs, indicating the device has been recruited as an exit node in the backconnect residential-proxy botnet that relays Bad Sushi phishing traffic and comparable IPIDEA/NetNut-fed campaigns.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1090.002, T1665, T1583.005, T1585.003
- **Data sources:** dns, firewall, network_ids_suricata, edr_network_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network (sourcetype="pan:traffic" OR sourcetype="stream:dns" OR sourcetype="suricata")
| eval c2_domain_hit=if(match(query, "(?i)(packetsdk\.(xyz|net|io)|holadns\.com|hexsdk\.com|dispatch1\.hexsdk\.com)") OR match(dest_domain, "(?i)(packetsdk\.(xyz|net|io)|holadns\.com|hexsdk\.com|dispatch1\.hexsdk\.com)"), 1, 0)
| eval c2_ip_hit=if(dest_ip IN ("49.51.68.143","45.78.214.188"), 1, 0)
| where c2_domain_hit=1 OR c2_ip_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_ip) as dest_ips values(dest_domain) as c2_domains by src_ip, host
| where count > 0
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("packetsdk.xyz","packetsdk.net","packetsdk.io","holadns.com","hexsdk.com","dispatch1.hexsdk.com") or RemoteIP in ("49.51.68.143","45.78.214.188")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| summarize EventCount=count(), Domains=make_set(RemoteUrl), IPs=make_set(RemoteIP) by DeviceName
| where EventCount > 0
```

### Sigma

```yaml
title: Residential-Proxy Tier-One C2 Callback (IPIDEA/NetNut SDK Infrastructure)
id: a1b2c3d4-3333-4a2b-9c3d-000000000001
status: experimental
description: Detects outbound callbacks to known IPIDEA/NetNut Tier One C2 domains and exit-node IPs, indicating a device has been recruited into the backconnect residential-proxy botnet feeding Bad Sushi and comparable phishing/fraud campaigns.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network
    - https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-12
tags:
    - attack.command-and-control
    - attack.t1090.002
    - attack.defense-evasion
    - attack.t1665
    - attack.resource-development
    - attack.t1583.005
    - attack.t1585.003
    - attack.tool.ipidea
    - attack.tool.netnut
logsource:
    category: dns
    definition: 'Requires DNS query logs or network/firewall logs capturing destination domain and IP (e.g. Suricata, PAN, EDR network events)'
detection:
    selection_domains:
        query|contains:
            - 'packetsdk.xyz'
            - 'packetsdk.net'
            - 'packetsdk.io'
            - 'holadns.com'
            - 'hexsdk.com'
    condition: selection_domains
falsepositives:
    - None expected for the exact domains listed; if extending the IP list with broader IPIDEA/NetNut exit-node ranges, shared residential IP space can occasionally include legitimate consumer traffic
level: critical
```

**Known false positives:**

- None expected for the exact domains/IPs listed; if extending the IP list with broader IPIDEA/NetNut exit-node ranges, shared residential IP space can occasionally include legitimate consumer traffic

**Tuning notes:** Refresh the C2 domain and exit-node IP list on a regular cadence, since Spamhaus/Bitsight/GTIG republish IOCs as IPIDEA/NetNut infrastructure churns and gets seized; extend to a full IPIDEA/NetNut Tier One domain feed rather than the static list shown here, and pivot on DeviceFileEvents/DeviceProcessEvents for PacketSDK/CastarSDK/HexSDK/EarnSDK artifacts to confirm device-level recruitment.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Financial Brand-Impersonation Phishing Delivery — Generic HELO Discriminator (KQL) (locked: unlock with TL Creds)
- Phishing Redirector Click-Through to .top Domain on Alibaba/Tencent Cloud VPS (KQL) (locked: unlock with TL Creds)
- Residential-Proxy Tier-One C2 Beacon — IPIDEA/NetNut SDK Callback (KQL) (locked: unlock with TL Creds)
- Financial Brand-Impersonation Phishing Delivery — Generic HELO Discriminator (Sigma) (locked: unlock with TL Creds)
- Phishing Redirector Click-Through to .top Domain on Alibaba/Tencent Cloud VPS (Sigma) (locked: unlock with TL Creds)
- Residential-Proxy Tier-One C2 Beacon — IPIDEA/NetNut SDK Callback (Sigma) (locked: unlock with TL Creds)
- Financial Brand-Impersonation Phishing Delivery — Generic HELO Discriminator (SPL) (locked: unlock with TL Creds)
- Phishing Redirector Click-Through to .top Domain on Alibaba/Tencent Cloud VPS (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `49.51.68[.]143`
- Domain: `packetsdk[.]xyz`
- IP address: `45.78.214[.]188`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Bad sushi: China-nexus phishers shift to residential proxies](https://www.spamhaus.org/resource-hub/compromised/bad-sushi-china-nexus-phishers-shift-to-residential-proxies/)
- [Bad sushi: China-nexus phishers shift to residential proxies (syndication)](https://securityboulevard.com/2025/10/bad-sushi-china-nexus-phishers-shift-to-residential-proxies/)
- [Let's talk about the danger of residential proxy networks](https://www.spamhaus.org/resource-hub/compromised/lets-talk-about-the-danger-of-residential-proxy-networks/)
- [When doorbells go rogue!](https://www.spamhaus.org/resource-hub/compromised/when-doorbells-go-rogue/)
- [Residential Proxy Services and Malware Ecosystems](https://www.bitsight.com/blog/residential-proxy-services-malware-ecosystems)
- [Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals](https://www.fbi.gov/investigate/cyber/alerts/2026/evading-residential-proxy-networks-protecting-your-devices-from-becoming-a-tool-for-criminals)
- [FBI Seizes NetNut Proxy Platform, Popa Botnet](https://krebsonsecurity.com/2026/07/fbi-seizes-netnut-proxy-platform-popa-botnet/)
- [To stop crims, Google starts dismantling residential proxy network they use to hide](https://www.theregister.com/2026/01/29/google_ipidea_crime_network/)
- [Disrupting the Largest Residential Proxy Network](https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network)
- [Google's Continued Disruption of Malicious Residential Proxy Networks](https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2471