one of fancy bear's preferred targets is web-based email services. a typical compromise will consist of web-based email users receiving an email urgently requesting that they change their passwords to avoid being hacked. the email will contain a link to a spoof website that is designed to mimic a real webmail interface, users will attempt to login and their credentials will be stolen. the url is often obscured as a shortened bit.ly link in order to get past spam filters. fancy bear sends these phishing emails primarily on mondays and fridays. they also send emails purportedly containing links to news items, but instead linking to malware drop sites that install toolkits onto the target's computer. fancy bear also registers domains that resemble legitimate websites, then create a spoof of the site to steal credentials from their victims. fancy bear has been known to relay its command traffic through proxy networks of victims that it has previously compromised.