# Bad Sushi: China-nexus phishing operations shift to residential proxy networks (Japan/Taiwan targeting)

> Spamhaus reports a China-nexus phishing actor targeting Japanese (and Taiwanese) users that, from early April 2025, moved phishing email emission from China Telecom/China Unicom subnets to residential proxy networks of roughly 3.5-4 million IPs. Source IPs grew from a single country to over 1.3 million IPs across 173 countries and 8,893 ASNs by May 2025, with about 250,000 IPs churned daily.

- **Published:** 2026-11-03T02:48:44Z
- **Last reviewed:** 2026-11-03T02:48:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5116
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5116.png
- **ID:** TL-2026-5116
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

Spamhaus (author Jonas Arnold, published 2025-10-16) documents a long-running phishing operation attributed only as 'China-nexus' that primarily targets users in Japan, with similar activity observed against Taiwanese internet users. The actor is unnamed in the source and no formal attribution to a named group is made.

Historically the phishing email was emitted from dedicated subnets at China Telecom and China Unicom across multiple Chinese provinces. Some subnets sent spam the way dial-up pools do, with dial-up-style PTR records configured at the Fujian branch of China Telecom, presumably to deceive postmasters and investigators. Spamhaus began listing these subnets in the Spamhaus Blocklist (SBL) in February 2023. Many Japanese email service providers were using SBL but not PBL or the combined ZEN dataset, so SBL listings sharply hurt the actor's deliverability. Phishing emission from China Telecom/Unicom continued at reduced volume.

In early April 2025 the actor began routing phishing email through residential proxy networks, reported at 3.5 to 4 million IPs with approximately 250,000 IPs cycled daily. Source IPs went from roughly 4,600 in one country to more than 1.3 million distinct IPs in 173 countries (8,893 autonomous systems) by May 2025, with Latin America prominent. The shift produced an explosion of IPv6 spam emissions and a surge of IPv6 listings. Spamhaus notes that the actors can discard individual residential proxies within minutes of the IPs being listed. Residential proxy activity accounted for 66% of XBL listings (3.34 million) and 37% of CSS listings (1.73 million). The proxies are described as largely running on compromised IoT devices and other consumer devices.

SMTP and URL tradecraft changed alongside the infrastructure. The actor moved from HELO strings impersonating targeted brands to generic, non-existent HELO names; moved from shared file networks to URLs on the .top TLD and then to redirectors; and hosted landing pages on Alibaba and Tencent VPS infrastructure. Brands impersonated in the lures include SBI, JCB and Hodaka. Spamhaus also observed some Japanese email service providers continuing to forward spam, apparently being deliberately targeted to 'wash' phishing emails and improve deliverability. Spamhaus separately notes a Brazil-nexus actor abusing about 500,000 residential-proxy IPs for brute-force login attempts weeks earlier.

Spamhaus assesses a lasting end to China-nexus phishing against Japan as unlikely given the actor's persistence and resources. The source discloses no specific IPs, domains, hashes or lure text, so the IOCs below are behavioral, infrastructural and entity indicators drawn from the report rather than atomic network indicators.

## MITRE ATT&CK

- T1566 Phishing
- T1566.002 Phishing: Spearphishing Link
- T1204.001 User Execution: Malicious Link
- T1583.001 Acquire Infrastructure: Domains
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1584.005 Compromise Infrastructure: Botnet
- T1608.005 Stage Capabilities: Link Target
- T1684.001 Impersonation
- T1090.002 Proxy: External Proxy
- T1665 Hide Infrastructure

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Bad Sushi - Webmail-Referred or Brand-Lure Visit to .top Phishing Host** (`TL-2026-5116-SPL-001`)

TL-2026-5116 (Bad Sushi, China-nexus phishing against Japan/Taiwan): after the actor abandoned shared file networks it moved phishing URLs to the .top TLD and then to redirectors. This search flags web-proxy requests to .top hosts that were referred from a webmail client or whose URL carries the impersonated brands SBI, JCB or Hodaka, i.e. a user clicking a phishing link.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1608.005
- **Data sources:** zscaler:nss:web proxy logs (index=proxy), UrlClickEvents (Defender for Office 365), web proxy (Sigma category proxy)
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=proxy sourcetype="zscaler:nss:web" earliest=-24h
```Bad Sushi TL-2026-5116: webmail-referred or brand-lure (SBI/JCB/Hodaka) visits to .top hosts```
| eval dest_host=lower(coalesce(host, dest)), url_l=lower(url), ref_l=lower(coalesce(referer, ""))
| where match(dest_host, "\.top$")
| eval webmail_referer=if(match(ref_l, "(outlook\.office\.com|outlook\.live\.com|mail\.google\.com|mail\.yahoo\.co\.jp)"), 1, 0)
| eval brand_lure=if(match(url_l, "(sbi|jcb|hodaka)"), 1, 0)
| where webmail_referer=1 OR brand_lure=1
| stats count as clicks dc(user) as users min(_time) as first_seen max(_time) as last_seen values(url) as urls max(brand_lure) as brand_lure max(webmail_referer) as webmail_referer by dest_host
| convert ctime(first_seen) ctime(last_seen)
| sort - clicks
````

### Microsoft KQL

```kql
UrlClickEvents
| where Timestamp > ago(24h)
| where ActionType in ('ClickAllowed', 'ClickedThrough')
| extend UrlHost = tolower(tostring(parse_url(Url).Host))
| where UrlHost endswith '.top'
| extend BrandLure = Url matches regex '(?i)(sbi|jcb|hodaka)'
| summarize Clicks = count(), Users = dcount(AccountUpn), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), SampleUrls = make_set(Url, 5), BrandLure = max(BrandLure) by UrlHost, Workload
| order by Clicks desc
```

### Sigma

```yaml
title: Bad Sushi Webmail-Referred or Brand-Lure Visit to .top Host
id: 5f0a3c1e-8b72-4d19-a6c4-2e91b7d03a51
status: experimental
description: Detects web proxy requests to .top hosts referred from a webmail client or carrying SBI, JCB or Hodaka brand strings, matching the Bad Sushi (TL-2026-5116) phishing URL tradecraft against Japanese and Taiwanese users.
references:
    - https://www.spamhaus.org/resource-hub/compromised/bad-sushi-china-nexus-phishers-shift-to-residential-proxies
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.execution
    - attack.t1204.001
    - attack.resource-development
    - attack.t1608.005
logsource:
    category: proxy
detection:
    selection_tld:
        cs-host|endswith: '.top'
    selection_webmail:
        cs-referer|contains:
            - 'outlook.office.com'
            - 'outlook.live.com'
            - 'mail.google.com'
            - 'mail.yahoo.co.jp'
    selection_brand:
        c-uri|contains:
            - 'sbi'
            - 'jcb'
            - 'hodaka'
    condition: selection_tld and (selection_webmail or selection_brand)
falsepositives:
    - Legitimate .top websites visited from webmail links
    - Brand strings appearing inside unrelated URL paths
level: medium

```

**Known false positives:**

- Legitimate .top sites opened from webmail by users
- Brand strings (sbi, jcb) appearing in unrelated URL paths or query strings

**Tuning notes:** Map host/url/referer/user to your proxy's field names (CIM Web: dest/url/http_referrer/user). Modern webmail often strips the referer, so the brand-lure branch carries most of the signal; tighten the brand regex to word boundaries if sbi/jcb substrings are noisy. Baseline and allowlist legitimate .top business domains. Community context (TL_OSINT_Scan) has no corroborated IOCs for this threat, only a loosely related campaign match on Alibaba-hosted phishing.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Bad Sushi - SBI/JCB/Hodaka Brand Impersonation from Unauthenticated Sender (locked: unlock with TL Creds)
- Bad Sushi - Multi-Client DNS Lookups of [indicator] Phishing Domains (locked: unlock with TL Creds)
- Bad Sushi - Single Sender Domain Rotating Across Many Source IPs (Residential Proxy Emission) (locked: unlock with TL Creds)
- Bad Sushi - URL Redirector Chain Fronting a [indicator] Landing Page (locked: unlock with TL Creds)
- Bad Sushi - Inbound SMTP from Dial-up-Style PTR on Chinese Networks (locked: unlock with TL Creds)
- Residential Proxy Credential Spray - Many Source IPs Failing Against One Account (locked: unlock with TL Creds)
- Bad Sushi - Form POST to [indicator] Phishing Landing Host (locked: unlock with TL Creds)
- Bad Sushi - Residential Proxy Churn with Invalid SMTP HELO Rejections (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Bad sushi: China-nexus phishers shift to residential proxies](https://www.spamhaus.org/resource-hub/compromised/bad-sushi-china-nexus-phishers-shift-to-residential-proxies)
- [Bad sushi: China-nexus phishers shift to residential proxies (Security Boulevard repost)](https://securityboulevard.com/2025/10/bad-sushi-china-nexus-phishers-shift-to-residential-proxies/)
- [Spamhaus: Let's Talk About the Danger of Residential Proxy Networks](https://www.spamhaus.org/resource-hub/compromised/lets-talk-about-the-danger-of-residential-proxy-networks/)
- [Spamhaus: When Doorbells Go Rogue!](https://www.spamhaus.org/resource-hub/compromised/when-doorbells-go-rogue/)
- [Spamhaus: Spammers Love Mobile Phone IP Space](https://www.spamhaus.org/resource-hub/spam/)
- [Spamhaus Resource Hub: Compromised](https://www.spamhaus.org/resource-hub/compromised/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5116