Fraudsters have appeared in the .RF zone.

The first fraudulent site in the Cyrillic domain zone .RF was the resource Shvydka-zakachka.rf.

The site resembles a torrent tracker and offers to download content from file sharing sites. When the user downloads a file, he receives an archive infected with the file on his own computer.

Trying to open the archive results in a request to send a paid SMS message. The response should contain a code to unlock the downloaded content. However, nothing actually happens.

Analysts from antivirus companies note that the use of Cyrillic domains in various scams will only become more frequent.