Japanese Police Force Shuts Down 34 Domains Selling Phishing Fraud Tools in Collaboration with Microsoft

Shutdown of Phishing Fraud Tool Sales Websites

The National Police Agency announced on February 14 that it has forcibly shut down 34 domains that were selling tools and accounts to phishing fraud perpetrators. This action was achieved through international collaboration with major organizations including Microsoft (MS).

How the Tools Work and Scale of Damage

The shutdown targeted the following tools:

CoGUI and IronMan are two fake website creation tools that were being sold. Using these tools, fraudsters could easily create large numbers of websites nearly identical to legitimate ones.

IronMan came with templates of over 2,300 Japanese companies and hospitals. According to the police, over half of approximately 120,000 fake websites detected in 2025 were created using these two tools.

Microsoft's analysis indicates that more than 100 million phishing emails targeting Japanese customers have been sent since May 2025.

How the Scam Works

1. Fraudsters impersonate legitimate financial institutions or companies and send fake emails
2. The emails contain links to fake websites designed to trick recipients into clicking
3. When recipients access the fake site, they are prompted to enter login credentials or credit card information
4. Fraudsters steal this information and use it for unauthorized purposes

Warning Signs

• Sender email address: Check if the email comes from the company's official domain rather than a suspicious address
• Unnatural email content: Grammar errors or messages creating unnecessary urgency
• URL destination: Hover over links in emails to verify the actual destination matches the company's official website
• Personal information requests: Banks and credit card companies never ask for personal information or passwords via email
• Information requests after login: Legitimate sites do not ask you to re-enter your password immediately after logging in

Prevention Tips

When receiving emails:

• Never click links in emails from companies; instead use official apps or bookmarks to access their sites
• Always verify the sender's email address
• If uncertain, contact the company directly through their official website rather than using email links

Security measures:

• Change passwords regularly
• Periodically check your financial institution's website for unauthorized access
• Enable two-factor authentication when available

If you become a victim:

• Immediately contact your credit card company or bank
• Change your password
• Report to police

Reporting Resources

• Police consultation hotline: #9110 (nationwide)
• National Police Agency Cyber Investigation Bureau: For reporting fraud and cybercrime information
• Consumer Affairs Agency: For consumer damage complaints
• Financial institutions: For reporting unauthorized transactions