[satysin]

I would assume he means it wasn't one of the big players such as Gmail or Outlook so when he saw traffic to mail.ru or whatever service it was it looked suspicious to his normal traffic profile.