Topic starter
25/10/2026 11:03 am
TL;DR: Phishing and reconnaissance in Japan arrived in predictable bursts, with 51.5% of observed activity as probing and 40.1% as genuine lures, according to Doppel. Mailbox-level telemetry gives defenders earlier evidence of regional campaigns than outside-in feeds can provide.
Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “Doppel Threat Intelligence: An Inside-Out View of Japan's Phishing Problem”.
By the numbers:
- 51.5% of activity wasn’t direct phishing; it was reconnaissance.
- 40.1% of everything the honeypot received was a genuine lure.
- 34% of malicious lures arrived on Mondays.
Key questions
Q: How should security teams use honeypot mailboxes for phishing defense?
A: Treat them as first-party telemetry sources, not just decoys.
Q: What are the signs that a phishing campaign is being timed strategically?
A: Repeated clustering around specific weekdays, workday start times, or lunch-hour windows is a strong indicator that delivery timing is part of the social engineering plan.
Q: Why do outside-in phishing feeds miss regional campaigns?
A: Because they depend on someone else observing the lure first.
Practitioner guidance
- Map phishing collection to target populations Place collection points where the campaign is meant to land, including regional mail environments and local-language inboxes, so you see lures before external feeds do.
- Feed lure telemetry into identity response Send captured sender domains, login pages, and credential-submission attempts into IAM, SOC, and fraud workflows so phishing becomes actionable identity telemetry.
- Tune monitoring to attacker timing patterns Adjust alerting, analyst coverage, and takedown priorities around weekday and working-hour surges rather than assuming uniform delivery across the day.
Bottom line: Phishing visibility fails when defenders rely on external feeds that only see the campaign after it has already begun to work.
Glossary terms: Phishing Honeypot, Social Engineering Attack Surface, Regional Phishing Ecosystem, Credential Submission Signal
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:17 pm
Inside-out visibility is the real control problem in phishing defense. Outside-in feeds are useful only after a lure has already been delivered, surfaced, or reported. In regional environments, that means the defender is still late even when the response is fast. The practical lesson is that coverage has to begin at the mailbox, not at the feed.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do phishing campaigns become an identity security problem, not just a mail problem?
A: Once a lure is built to capture credentials or session tokens, the incident moves into IAM territory. The operational risk is account compromise, reused passwords, and downstream access abuse. Security teams should therefore treat phishing telemetry as input to identity control, not as a standalone awareness metric.
👉 Read our full editorial: Japan’s phishing gap shows why inside-out visibility matters
This post was modified 7 days ago by NHI Mgmt Group