Warning ! third-party regarding subdomains of ru[.]com using the names of US states

This Multi-State Infrastructure Information Sharing and Analysis Center (MS-ISAC) Advisory is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cybercriminals. Even though the services provided by the MS-ISAC are only available to the public sector, all private sector organizations are encouraged to review this Advisory and implement appropriate mitigation measures.

Summary
The MS-ISAC received notice from a trusted third-party regarding subdomains of ru[.]com using the names of US states. Although many of them are not currently active, these domains could be used for phishing campaigns or other malicious activity like malspam. The domains follow a consistent template with using standard state names (no acronyms, spacing, or hyphens) in the format [.]ru[.]com. For example:

This information is being provided for situational awareness. The MS-ISAC recommends blocking the domain at your web filter, on any edge devices, and in your spam filtering solution. If your organization utilizes the MS-ISAC Malicious Domain Blocking and Reporting (MDBR) Service, all of the domains have been added. While some of these domains are currently up for sale, the domain could become active at any time.