Attacker uses the homograph trick
The assault started on the evening of Saturday, October 6, with messages that impersonated the Icelandic police. The emails asked the recipients to come in for questioning and warned them that non-compliance resulted in issuing an arrest warrant.
A link leading to a spoofed version of Lögreglan - the Icelandic police, seemingly offered more information on the matter.
To make everything appear authentic, the author of the campaign resorted to the homograph trick to register a domain that looked like the original 'logreglan.is.'