Skip to navigation

Threat reportPhishingTL-2026-5116

Bad Sushi: China-nexus phishing operations shift to residential proxy networks (Japan/Taiwan targeting)

highACTIVE

Spamhaus reports a China-nexus phishing actor targeting Japanese (and Taiwanese) users that, from early April 2025, moved phishing email emission from China Telecom/China Unicom subnets to residential proxy networks of roughly 3.5-4 million IPs. Source IPs grew from a single country to over 1.3 million IPs across 173 countries and 8,893 ASNs by May 2025, with about 250,000 IPs churned daily. First disclosed .

Key facts for Bad Sushi phishing

IdentifiersTL-2026-5116
Also known asBad sushi
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsVarious Email service providers and end users in Japan and Taiwan; brand customers of SBI, JCB and Hodaka
Nation-state nexusChina
MITRE ATT&CK techniquesT1090.002 Proxy: External Proxy, T1204.001 User Execution: Malicious Link, T1566 Phishing, T1566.002 Phishing: Spearphishing Link, T1583.001 Acquire Infrastructure: Domains, T1583.003 Acquire Infrastructure: Virtual Private Server, T1584.005 Compromise Infrastructure: Botnet, T1608.005 Stage Capabilities: Link Target, T1665 Hide Infrastructure, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorsfinance, consumer, email-service-providers, general-public
Target regionsjapan, taiwan
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage for Bad Sushi phishing

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5116 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Bad Sushi - Webmail-Referred or Brand-Lure Visit to .top Phishing Host

TL-2026-5116 (Bad Sushi, China-nexus phishing against Japan/Taiwan): after the actor abandoned shared file networks it moved phishing URLs to the .top TLD and then to redirectors. This search flags web-proxy requests to .top hosts that were referred from a webmail client or whose URL carries the impersonated brands SBI, JCB or Hodaka, i.e. a user clicking a phishing link.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.002, T1204.001, T1608.005
  • Data sources: zscaler:nss:web proxy logs (index=proxy), UrlClickEvents (Defender for Office 365), web proxy (Sigma category proxy)
  • Severity: high
  • Confidence: medium

Splunk SPL

index=proxy sourcetype="zscaler:nss:web" earliest=-24h
```Bad Sushi TL-2026-5116: webmail-referred or brand-lure (SBI/JCB/Hodaka) visits to .top hosts```
| eval dest_host=lower(coalesce(host, dest)), url_l=lower(url), ref_l=lower(coalesce(referer, ""))
| where match(dest_host, "\.top$")
| eval webmail_referer=if(match(ref_l, "(outlook\.office\.com|outlook\.live\.com|mail\.google\.com|mail\.yahoo\.co\.jp)"), 1, 0)
| eval brand_lure=if(match(url_l, "(sbi|jcb|hodaka)"), 1, 0)
| where webmail_referer=1 OR brand_lure=1
| stats count as clicks dc(user) as users min(_time) as first_seen max(_time) as last_seen values(url) as urls max(brand_lure) as brand_lure max(webmail_referer) as webmail_referer by dest_host
| convert ctime(first_seen) ctime(last_seen)
| sort - clicks

Microsoft KQL

UrlClickEvents
| where Timestamp > ago(24h)
| where ActionType in ('ClickAllowed', 'ClickedThrough')
| extend UrlHost = tolower(tostring(parse_url(Url).Host))
| where UrlHost endswith '.top'
| extend BrandLure = Url matches regex '(?i)(sbi|jcb|hodaka)'
| summarize Clicks = count(), Users = dcount(AccountUpn), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), SampleUrls = make_set(Url, 5), BrandLure = max(BrandLure) by UrlHost, Workload
| order by Clicks desc

Sigma

title: Bad Sushi Webmail-Referred or Brand-Lure Visit to .top Host
id: 5f0a3c1e-8b72-4d19-a6c4-2e91b7d03a51
status: experimental
description: Detects web proxy requests to .top hosts referred from a webmail client or carrying SBI, JCB or Hodaka brand strings, matching the Bad Sushi (TL-2026-5116) phishing URL tradecraft against Japanese and Taiwanese users.
references:
    - https://www.spamhaus.org/resource-hub/compromised/bad-sushi-china-nexus-phishers-shift-to-residential-proxies
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.execution
    - attack.t1204.001
    - attack.resource-development
    - attack.t1608.005
logsource:
    category: proxy
detection:
    selection_tld:
        cs-host|endswith: '.top'
    selection_webmail:
        cs-referer|contains:
            - 'outlook.office.com'
            - 'outlook.live.com'
            - 'mail.google.com'
            - 'mail.yahoo.co.jp'
    selection_brand:
        c-uri|contains:
            - 'sbi'
            - 'jcb'
            - 'hodaka'
    condition: selection_tld and (selection_webmail or selection_brand)
falsepositives:
    - Legitimate .top websites visited from webmail links
    - Brand strings appearing inside unrelated URL paths
level: medium

Known false positives:

  • Legitimate .top sites opened from webmail by users
  • Brand strings (sbi, jcb) appearing in unrelated URL paths or query strings

Tuning notes: Map host/url/referer/user to your proxy's field names (CIM Web: dest/url/http_referrer/user). Modern webmail often strips the referer, so the brand-lure branch carries most of the signal; tighten the brand regex to word boundaries if sbi/jcb substrings are noisy. Baseline and allowlist legitimate .top business domains. Community context (TL_OSINT_Scan) has no corroborated IOCs for this threat, only a loosely related campaign match on Alibaba-hosted phishing.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Bad Sushi - SBI/JCB/Hodaka Brand Impersonation from Unauthenticated Sender · unlock with TL Creds
  • Bad Sushi - Multi-Client DNS Lookups of [indicator] Phishing Domains · unlock with TL Creds
  • Bad Sushi - Single Sender Domain Rotating Across Many Source IPs (Residential Proxy Emission) · unlock with TL Creds
  • Bad Sushi - URL Redirector Chain Fronting a [indicator] Landing Page · unlock with TL Creds
  • Bad Sushi - Inbound SMTP from Dial-up-Style PTR on Chinese Networks · unlock with TL Creds
  • Residential Proxy Credential Spray - Many Source IPs Failing Against One Account · unlock with TL Creds
  • Bad Sushi - Form POST to [indicator] Phishing Landing Host · unlock with TL Creds
  • Bad Sushi - Residential Proxy Churn with Invalid SMTP HELO Rejections · unlock with TL Creds

Indicators of compromise for Bad Sushi phishing

As of 2026-11-03, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5116.

9 indicators of compromise · unlock with TL Creds. Compare plans

How Bad Sushi phishing works

Spamhaus (author Jonas Arnold, published 2025-10-16) documents a long-running phishing operation attributed only as 'China-nexus' that primarily targets users in Japan, with similar activity observed against Taiwanese internet users. The actor is unnamed in the source and no formal attribution to a named group is made.

Historically the phishing email was emitted from dedicated subnets at China Telecom and China Unicom across multiple Chinese provinces. Some subnets sent spam the way dial-up pools do, with dial-up-style PTR records configured at the Fujian branch of China Telecom, presumably to deceive postmasters and investigators. Spamhaus began listing these subnets in the Spamhaus Blocklist (SBL) in February 2023. Many Japanese email service providers were using SBL but not PBL or the combined ZEN dataset, so SBL listings sharply hurt the actor's deliverability. Phishing emission from China Telecom/Unicom continued at reduced volume.

In early April 2025 the actor began routing phishing email through residential proxy networks, reported at 3.5 to 4 million IPs with approximately 250,000 IPs cycled daily. Source IPs went from roughly 4,600 in one country to more than 1.3 million distinct IPs in 173 countries (8,893 autonomous systems) by May 2025, with Latin America prominent. The shift produced an explosion of IPv6 spam emissions and a surge of IPv6 listings. Spamhaus notes that the actors can discard individual residential proxies within minutes of the IPs being listed. Residential proxy activity accounted for 66% of XBL listings (3.34 million) and 37% of CSS listings (1.73 million). The proxies are described as largely running on compromised IoT devices and other consumer devices.

SMTP and URL tradecraft changed alongside the infrastructure. The actor moved from HELO strings impersonating targeted brands to generic, non-existent HELO names; moved from shared file networks to URLs on the .top TLD and then to redirectors; and hosted landing pages on Alibaba and Tencent VPS infrastructure. Brands impersonated in the lures include SBI, JCB and Hodaka. Spamhaus also observed some Japanese email service providers continuing to forward spam, apparently being deliberately targeted to 'wash' phishing emails and improve deliverability. Spamhaus separately notes a Brazil-nexus actor abusing about 500,000 residential-proxy IPs for brute-force login attempts weeks earlier.

Spamhaus assesses a lasting end to China-nexus phishing against Japan as unlikely given the actor's persistence and resources. The source discloses no specific IPs, domains, hashes or lure text, so the IOCs below are behavioral, infrastructural and entity indicators drawn from the report rather than atomic network indicators.

MITRE ATT&CK techniques by tactic:

Command and Control

T1090.002 Proxy: External Proxy; T1665 Hide Infrastructure

Execution

T1204.001 User Execution: Malicious Link

Initial Access

T1566 Phishing; T1566.002 Phishing: Spearphishing Link

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1583.003 Acquire Infrastructure: Virtual Private Server; T1584.005 Compromise Infrastructure: Botnet; T1608.005 Stage Capabilities: Link Target

Defense Evasion

T1684.001 Impersonation

Remediation for Bad Sushi phishing

Immediate actions

  • Reject SMTP connections whose HELO/EHLO is a non-existent, unresolvable or invalid hostname
  • Use IP reputation data covering residential/proxy and IoT-sourced listings (SBL, XBL, CSS, PBL or ZEN), not SBL alone
  • Enforce SPF, DKIM and DMARC authentication results, especially on email forwarding infrastructure
  • Block or rewrite URLs on the .top TLD and on redirector chains pending analysis

Workarounds

  • Email service providers should not forward or relay unauthenticated mail on behalf of third parties, to avoid washing phishing email

Longer-term hardening

  • Deploy threat intelligence that identifies malicious traffic on non-SMTP protocols from residential proxy exit nodes
  • Disconnect compromised IoT devices from the network and remediate them
  • Share evidence of impersonation with the affected brands (e.g. SBI, JCB, Hodaka)
  • Run awareness campaigns for end users, abuse desks and IT staff

Affected and fixed versions

  • Various — Email service providers and end users in Japan and Taiwan; brand customers of SBI, JCB and Hodaka

Timeline of Bad Sushi phishing

  • Spamhaus publishes 'When Doorbells Go Rogue!' describing residential proxy networks abused to send spam from home networks
  • Spamhaus begins listing China Telecom and locked-ioc-3 dedicated to phishing emission (aimed at Japanese users) in the SBL
  • Spamhaus publishes 'Spammers Love Mobile Phone IP Space', related background on spam from consumer IP space
  • Weeks before the April shift, a Brazil-nexus actor is observed abusing about 500,000 residential-proxy IPs for brute-force login attempts (approximate date; source says 'weeks prior')
  • In early April the China-nexus phishing actor shifts to residential proxies (3.5-4 million IPs, ~250,000 IPs churned daily), with an explosion of IPv6 spam and generic non-existent HELOs
  • By May source IPs grow from ~4,600 in one country to over 1.3 million across 173 countries and 8,893 ASNs
  • Spamhaus publishes 'Bad sushi: China-nexus phishers shift to residential proxies'

Sources cited for Bad Sushi phishing

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats