Germany’s .su Footprint: What Is Hiding in Soviet-Coded Domains
Our first brief mapped the .su namespace globally and flagged two Western European jurisdictions where what we called infrastructure distance concentrates most heavily: the Netherlands and Germany. This brief takes Germany on its own terms.
Of roughly 109,000 domains in the global dataset, close to 2,000 currently resolve to a German IP address, the second-largest Western European concentration, and by far the oldest. We selected a working sample for individual investigation through WHOIS, DNS, TLS certificates and live content, and report below what we found, and what we could not resolve.
A note on method
We grouped domains by where their servers currently sit, not by who registered them. Hosting location cannot tell you a registrant’s nationality or whereabouts. What it tells you is which infrastructure an operator chose, and that choice is rarely accidental.
Bad actors gravitate toward hosts that ask few questions and act slowly on abuse reports. So when dozens of near-identical sites cluster on the same server, the same nameservers, the same jurisdiction, that is rarely a coincidence of geography. It is a shared playbook. Hosting clusters do not by themselves reveal who is behind a scam. They reveal where the shadows fall, and which corners of the internet keep attracting the same kind of trouble.
The registration curve
Germany’s curve tells a different story from other slices of the namespace. Activity begins in the early 2000s, spikes once in 2007, then holds steady for two decades at 40 to 88 new registrations a year, a rhythm consistent with defensive brand registrations, hobbyist purchases and small-scale investing.
Then the pattern breaks: 126 in 2024, 386 in 2025, and 361 in the first half of 2026 alone. On that run rate, 2026 will be the busiest year for German-hosted .su registration in the zone’s history.
This is not a pre-deadline rush against a mature base. It is a mature base that recently began accelerating sharply.
Key findings
~2,000 .su domains resolving to a German IP address
69% carry a measurable crawl-relevance score, meaning more than two in three are indexed, discoverable and actively serving content. This is a live population, not a museum of abandoned registrations.
25 use Cyrillic or internationalised encoding, confirming the footprint is built for a Russian-speaking audience despite sitting in Western Europe, a detail that matters for takedown cooperation, since German hosts will rarely be equipped to read what they are hosting.
221 domains, about one in ten, carry an expiry date falling before the 1 September 2026 identity-verification deadline itself.
What we found inside
The most operationally revealing cluster follows a single alphabetical naming convention: 27 domains registered progressively through 2025, all through the same Russian registrar, all resolving to one IPv4 address on Hetzner infrastructure in Germany. Every domain shares the same nameservers, the same SOA record, and an unusual SPF configuration distinctive enough to attribute all 27 to one operator.
What separates this from ordinary domain squatting is the mail configuration. Every domain in the series carries its own MX record, and none carries DMARC. This is a mail-enabled infrastructure set built for two-way correspondence with real people, not a dormant brand-defence portfolio.
The pages themselves present a Russian-language recruitment pitch offering work in the European Union at attractive monthly earnings, each funnelling visitors to a single Telegram or WhatsApp contact. Historical captures show the front-end template has stayed fixed while the human contact layer underneath has already been rotated at least once, a hallmark of operational security in scam and trafficking-adjacent recruitment networks, not of a legitimate employment agency.
One domain inside the same letter sequence does something different. Rather than a job pitch, it presents a page requesting a face photograph, scanned identity documents and proof of residence, wrapped in consent language designed to look like routine account onboarding. That is not recruitment. It is an identity and biometric harvesting mechanism, the raw material criminal networks use to bypass Know-Your-Customer checks and open verified accounts under someone else’s identity.
Two further domains on the identical infrastructure fingerprint impersonate a real, established visa-processing service, and one of them displayed a third pitch entirely: a Russian-language crypto “education” page promising high annual returns from staking, funnelling every visitor to a single private chat contact.
One IP address, one operator, three storefronts: a job abroad, a visa service, a crypto course, each a different lure pointed at a different anxiety, all running on infrastructure built to send and receive mail nobody can verify. That is what makes this class of network resilient: block one storefront, and the mail-enabled infrastructure underneath keeps running.
Three further cases
Not every notable domain in the footprint fits the recruitment-and-impersonation model. Three others show how wide the abuse surface really is.
A dark-web marketplace hosted openly on the clearnet, operating as a directory of affiliated shops offering close to the full catalogue of financial cybercrime. Content of this kind historically lived almost exclusively on Tor hidden services; the shift to clearnet storefronts on cheap, loosely regulated TLDs is a documented industry trend.
A pseudo-state portal presenting itself as an official ministry of a country that dissolved in 1991, built, according to its own page metadata, with a modern AI-assisted app builder. A multilingual, institution-shaped shell that one operator can now stand up in an afternoon.
A domain carrying the name of a notorious deplatformed extremist site, now stripped of ideological content and plugged into a traffic-monetisation broker that routes each visitor to whichever advertiser currently has budget. The same rotation that serves a harmless quiz funnel on one visit could serve something considerably worse on the next.
What this means
Country-by-IP slices of the .su namespace do not behave uniformly, which is exactly why each has to be investigated on its own terms. What looks in one country’s footprint like a harmless collection of defensive brand registrations looks, in another, like an active fraud cluster on shared, mail-enabled infrastructure. Germany’s footprint contains both.
The only responsible way to tell which is which is the discipline we applied here: rank the domains, date them, match the names, verify through WHOIS and DNS, and report honestly on what the evidence does and does not support.
The September 2026 deadline turns that discipline into a live decision point. Every Western brand holder, law firm or security team currently managing a defensive .su registration through German infrastructure now faces a genuine choice: complete Russian state identity verification to keep the domain, or let it lapse into the redemption pool, where, as the sections above show, it can be picked up within hours by the next operator waiting for exactly that kind of opening.
24/7 Crisis Support through a state of the art Global Security Operations Center.
How many .su domains are hosted in Germany?
Close to 2,000 currently resolve to a German IP address, the second-largest Western European concentration in our census.
Why would a Russian-registered domain be hosted in Germany?
Keeping the registrar Russian while moving hosting to Western Europe lets an operator sidestep the default suspicion and geo-blocking that corporate firewalls and threat-intelligence feeds increasingly apply to Russian-origin IP space.
Does hosting location identify who is behind a domain?
No. Hosting location tells you which infrastructure an operator chose, not their nationality or whereabouts. Attribution requires corroborating evidence across WHOIS, DNS and content.
What should an organisation do about the September 2026 deadline?
Establish whether it holds any .su registrations, decide whether to complete verification or let them lapse, and understand that a lapsed brand-name domain can be re-registered by a third party within hours.
Mihaela Vata heads the Business Intelligence Practice department at NSSG, overseeing complex, high-stakes intelligence engagements for domestic and international clients. She manages the firm’s capabilities across Investigations & Due Diligence, Reputational Risk & Crisis Monitoring, as well as Geopolitical & Strategic Intelligence, ensuring that intelligence outputs are closely aligned with business decision-making, risk exposure, and strategic objectives.
With nearly 20 years of experience spanning national security, counter-terrorism, forensic intelligence, and corporate risk advisory, Mihaela brings a rare combination of operational intelligence background and private-sector strategic advisory expertise.
Prior to joining NSSG, she served with the Romanian Intelligence Service, acting as a trusted analyst and advisor on both operational and strategic matters. Her subsequent work in forensic intelligence and AML/CFT analysis in the private sector further strengthened her ability to translate complex geopolitical, regulatory, and security dynamics into actionable insights for corporate leaders. Mihaela is an alumna of the George C. Marshall European Center for Security Studies and holds advanced degrees in National Security Intelligence Management.
The .su Domain Explained: The Soviet TLD That Never Switched Off
The .su top-level domain was assigned to the Soviet Union in September 1990, fourteen months before the country ceased to exist. It should not still be running in 2026. It is, with over 109,000 active domains, registered across 80 countries.
This is the first of three intelligence briefs in which NSSG examines the .su ecosystem: its governance, its ownership structure, and the risk it presents to organisations that have never given it a second thought. The summary below sets out what we found. The full brief is available to download.
The numbers
109,269 active .su domains as of June 2026
80 countries represented in the registrant base
77% of registrations originate in Russia
1 September 2026: deadline for mandatory identity verification under Russian Federal Law No. 569-FZ
2030: ICANN’s projected retirement date for the zone
Why a domain for a country that no longer exists is still online
Other collapsed states had their country codes retired. East Germany’s .dd was never fully implemented, Czechoslovakia’s .cs was deleted in 1995, Yugoslavia’s .yu was removed in 2010. .su persisted.
The reason is structural rather than accidental. ICANN can remove .su from the root zone, but it cannot compel Russia to stop operating the domain’s nameservers. Since 2009 the zone has been maintained by Technical Center of Internet LLC, a subsidiary of the state-owned telecommunications operator Rostelecom, which also runs the .ru and .рф registries. That makes .su a component of Russia’s national internet infrastructure rather than an orphaned relic.
The Moscow-based Foundation for Internet Development, one of the entities responsible for managing the domain, has publicly acknowledged shortcomings in its regulatory framework and limits on its ability to remove malicious content.
Who benefits from keeping it alive
Four distinct groups have an interest in .su continuing to operate.
State actors benefit from jurisdictional ambiguity. When a criminal site runs on .su, which authority has regulatory competence is genuinely unclear, and that ambiguity has never been urgent to resolve.
Cybercriminals benefit from lax enforcement. When Russian authorities tightened oversight of .ru around 2011–2012, operators migrated to .su in volume; the zone’s population doubled in 2011 and again in 2012. Botnet command-and-control, ransomware distribution, credential theft and phishing infrastructure have all made extensive use of it.
Ideological actors benefit from its symbolic weight. The Soviet resonance carries meaning for ultranationalist and Eurasianist networks, and several well-known figures in that space have chosen .su deliberately for their platforms.
Registrars benefit commercially. The zone generates fees, and the incoming verification requirement has itself created a new revenue line in “trusted administrator” services for non-resident holders.
What .su sites actually contain
The ecosystem is more varied than its reputation suggests, which is precisely what makes it difficult to assess at a glance. Our taxonomy covers five categories:
Cybercriminal infrastructure: the most serious documented risk, spanning botnet command-and-control, ransomware payment portals, credential theft and breach-data publishing
Political extremism and influence operations: ideologically motivated content united primarily by hostility to Western liberal institutions
Counterfeit goods, diverted supply chains and brand impersonation: directly relevant to fashion, retail and consumer goods
Unregulated commercial and entertainment content: illegal streaming, gambling platforms, grey-market software
Nostalgic and curated content: minimal risk, maximum symbolic signal
Enforcement is unusually difficult. The .su dispute resolution process is not aligned with standard WIPO procedures, and takedown requests depend on cooperation from Russian-controlled infrastructure operators.
What changes on 1 September 2026
From that date, Federal Law No. 569-FZ requires every administrator of a .ru, .рф or .su domain to verify their identity through Gosuslugi, Russia’s national identification platform. Registration, renewal, transfer, even a DNS change, all of it requires a verified account. Domains that cannot complete verification will not renew.
Roughly 80,000 non-resident clients at a single registrar hold domains they cannot verify without a Russian account, which typically requires physical presence in Russia to create. A trusted-administrator mechanism has been created to bridge that gap, under which a verified entity holds formal administrative responsibility while DNS management and renewal rights stay with the non-resident holder.
The first organisations to show interest in that service were international companies providing intellectual property and digital asset protection to global brands, which tells you that major brands already hold defensive .su registrations, and are now managing a compliance problem attached to them.
What this means for your organisation
Three developments follow predictably from the deadline.
A defensive registration wave by major international brands, formalising .su holdings before the deadline to prevent impersonators taking the names instead.
Criminal infrastructure migration or adaptation. Sophisticated operators will route around verification using shell identities or the trustee mechanism, or move to adjacent jurisdictionally difficult TLDs. Monitoring for that migration is part of the threat picture.
Increased Russian state visibility into the registrant base. For non-resident holders this raises real questions about registration data held in Russian government systems, and warrants legal advice.
The practical question for most organisations is simpler than any of this: do you know whether your brand name is registered in the .su space, and by whom? Most do not.
24/7 Crisis Support through a state of the art Global Security Operations Center.
What is the .su domain?
A country-code top-level domain assigned to the Soviet Union in September 1990. The state dissolved in December 1991; the domain was never decommissioned and remains in active use.
Is .su still active in 2026?
Yes. Over 109,000 domains were active as of June 2026, and ICANN’s projected retirement date for the zone is 2030.
Who controls the .su registry?
Technical Center of Internet LLC, a subsidiary of the Russian state-owned telecommunications operator Rostelecom, has maintained the zone since 2009.
Why is .su considered a security risk?
Jurisdictional ambiguity, limited enforcement capacity and a dispute-resolution process not aligned with standard WIPO procedure make takedowns unusually difficult, which has historically attracted criminal and extremist infrastructure.
What happens to .su domains on 1 September 2026?
Every administrator must verify their identity through Russia’s national ESIA platform. Domains that cannot complete verification will not renew.
Mihaela Vata heads the Business Intelligence Practice department at NSSG, overseeing complex, high-stakes intelligence engagements for domestic and international clients. She manages the firm’s capabilities across Investigations & Due Diligence, Reputational Risk & Crisis Monitoring, as well as Geopolitical & Strategic Intelligence, ensuring that intelligence outputs are closely aligned with business decision-making, risk exposure, and strategic objectives.
With nearly 20 years of experience spanning national security, counter-terrorism, forensic intelligence, and corporate risk advisory, Mihaela brings a rare combination of operational intelligence background and private-sector strategic advisory expertise.
Prior to joining NSSG, she served with the Romanian Intelligence Service, acting as a trusted analyst and advisor on both operational and strategic matters. Her subsequent work in forensic intelligence and AML/CFT analysis in the private sector further strengthened her ability to translate complex geopolitical, regulatory, and security dynamics into actionable insights for corporate leaders. Mihaela is an alumna of the George C. Marshall European Center for Security Studies and holds advanced degrees in National Security Intelligence Management.
