Service abuse: Kagoya.net-hosted domains sending English business lures

calendar Aug 27, 2026 · Attack surface reduction  ·
Share on: linkedin copy

Flags inbound mail routed through infrastructure tied to the Japanese hosting provider Kagoya.net where the message body is written in English, a mismatch that surfaces abuse of these mail servers for business-themed lures.

Sublime rule (View on GitHub)

 1name: "Service abuse: Kagoya.net-hosted domains sending English business lures"
 2description: "Flags inbound mail routed through infrastructure tied to the Japanese hosting provider Kagoya.net where the message body is written in English, a mismatch that surfaces abuse of these mail servers for business-themed lures."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and any(headers.domains, .root_domain == "kagoya.net")
 8  and ml.nlu_classifier(body.current_thread.text).language == "english"
 9  and not (
10    (length(headers.references) > 0 or headers.in_reply_to is not null)
11    and (subject.is_forward or subject.is_reply)
12    and length(body.previous_threads) >= 1
13  )  
14tags:
15  - "Attack surface reduction"
16attack_types:
17  - "BEC/Fraud"
18  - "Spam"
19tactics_and_techniques:
20  - "Impersonation: Brand"
21  - "Social engineering"
22  - "Spoofing"
23detection_methods:
24  - "Natural Language Understanding"
25  - "Header analysis"
26  - "Sender analysis"
27id: "675ea5f3-43a2-5ee5-b990-288739fd493e"

Related rules

to-top