"In terms of implementation, the most interesting one is “Іron Wаllеt” (the I, a, and e are Cyrillic). Three seconds after install, it fetches the phishing page’s URL from the first record of a NocoDB spreadsheet and opens it [...] The API key had write access, so I wiped the spreadsheet."
You do realize that the english speaking world is much bigger than the USA right? The fact it is the default language for business/trade means that it is known and spoken all over the world. So no, there is no "reasonnable default".
In case you didn't know, it is called english for a reason, USA didn't create it.
Also there is absolutely 0 correlation between where a website is based or hosted and its visitors origins unless it tackles only topic that are specific to a particular area ou in a language known by a very limited population.
