Huh, so phishing, eh? Underwhelming. I don't understand the Russian connection. Is it because the ultimate "account.google.com-security..." domain is associated

Huh, so phishing, eh? Underwhelming. I don't understand the Russian connection. Is it because the ultimate "account.google.com-security..." domain is associated with Russia? Also, from the article: > It’s unclear why the hackers used the encoded strings, which effectively reveal their targets to anyone. Kyle Ehmke, a threat intelligence researcher at security firm ThreatConnect, argued that “the strings might help them keep track of or better organize their operations, tailor credential harvesting pages to specific victims, monitor the effectiveness of their operations, or diffuse their operations against various targets across several URLs to facilitate continuity should one of the URLs be discovered.” It seems like because with the email encoded in the URL you can prefill the "someone logged into your Google Account: XYZ", right? That way you could send out millions of these things to harvest email/password combinations. I don't understand how or why they would do it any way but that way.