Attackers are stealing accounts of Russian hosting providers.

Doctor Web reported this. According to the company, a new fraudulent scheme has emerged on the RuNet, designed to steal administrator accounts from websites belonging to Russian hosting companies.

The attack has already affected clients of Peterhost, SpaceWeb, and FirstVDS. Experts believe that other companies providing similar services will be affected in the future.

The attackers used the WHOIS service to determine the list of websites available from the selected hosting provider, and in the same way they determined the registrar's email address.

After this, the domain owner received a letter allegedly from the hosting provider's administration.

The letters had varying content, for example, with information that the hosted site had allegedly exceeded the load limit for the current tariff plan.

To solve this problem, the email recipient was asked to click a link that led to a fake web page that looked like the original page on the hosting provider's official website. After the user entered their account credentials into the appropriate form, these details fell into the hands of the scammers.