My buddies at GRU are at it again. Very creative bait this time, I almost believed it.. Good that I GOGLED the domain first. 
(so the phishing bait implies the FSB - who control the Donetsk-based MGB) - are trying to hack my account. If this is GRU, it would be GRU using FSB as bait which is ironic.. If it's FSB themselves, it's just onanic)
So the "from:" domain is parked at reg.ru. But the active click-through payload domain is this. Interesting, a .ru google look-alike domain, meaning most targets are meant to be within RU. We saw something similar in a phishing campaign about six months ago.
These other domains are hosted on the same server. So, do not stay at Hotel Bono. You can only check in but you can't check out.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
