Japan’s phishing ecosystem: what outside-in detection misses

TL;DR: Phishing and reconnaissance arrive in predictable bursts, with 51.5% of observed activity as probing and 40.1% as genuine lures, according to Doppel’s five-week honeypot project in Japan, exposing how outside-in threat feeds miss regionally targeted campaigns until after compromise. Inbox-level visibility changes the control point from reaction to earlier detection.

Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “Doppel Threat Intelligence: An Inside-Out View of Japan's Phishing Problem”.

By the numbers:

• 51.5% of activity wasn’t direct phishing; it was reconnaissance.
• 40.1% of everything the honeypot received was a genuine lure.
• 34% of malicious lures arrived on Mondays.

Key questions

Q: Why do outside-in phishing feeds miss regional campaigns?

A: Because they depend on someone else observing the lure first.

Q: How should security teams use honeypot mailboxes for phishing defense?

A: Treat them as first-party telemetry sources, not just decoys.

Q: What are the signs that a phishing campaign is being timed strategically?

A: Repeated clustering around specific weekdays, workday start times, or lunch-hour windows is a strong indicator that delivery timing is part of the social engineering plan.

Practitioner guidance

• Map phishing collection to target populations Place collection points where the campaign is meant to land, including regional mail environments and local-language inboxes, so you see lures before external feeds do.
• Feed lure telemetry into identity response Send captured sender domains, login pages, and credential-submission attempts into IAM, SOC, and fraud workflows so phishing becomes actionable identity telemetry.
• Tune monitoring to attacker timing patterns Adjust alerting, analyst coverage, and takedown priorities around weekday and working-hour surges rather than assuming uniform delivery across the day.

Bottom line: Phishing visibility fails when defenders rely on external feeds that only see the campaign after it has already begun to work.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →