Home|The .su Domain Explained: The Soviet TLD That Never Switched Off
The .su Domain Explained: The Soviet TLD That Never Switched Off
The .su Domain Explained: The Soviet TLD That Never Switched Off
The .su top-level domain was assigned to the Soviet Union in September 1990, fourteen months before the country ceased to exist. It should not still be running in 2026. It is, with over 109,000 active domains, registered across 80 countries.
This is the first of three intelligence briefs in which NSSG examines the .su ecosystem: its governance, its ownership structure, and the risk it presents to organisations that have never given it a second thought. The summary below sets out what we found. The full brief is available to download.
The numbers
109,269 active .su domains as of June 2026
80 countries represented in the registrant base
77% of registrations originate in Russia
1 September 2026: deadline for mandatory identity verification under Russian Federal Law No. 569-FZ
2030: ICANN’s projected retirement date for the zone
Why a domain for a country that no longer exists is still online
Other collapsed states had their country codes retired. East Germany’s .dd was never fully implemented, Czechoslovakia’s .cs was deleted in 1995, Yugoslavia’s .yu was removed in 2010. .su persisted.
The reason is structural rather than accidental. ICANN can remove .su from the root zone, but it cannot compel Russia to stop operating the domain’s nameservers. Since 2009 the zone has been maintained by Technical Center of Internet LLC, a subsidiary of the state-owned telecommunications operator Rostelecom, which also runs the .ru and .рф registries. That makes .su a component of Russia’s national internet infrastructure rather than an orphaned relic.
The Moscow-based Foundation for Internet Development, one of the entities responsible for managing the domain, has publicly acknowledged shortcomings in its regulatory framework and limits on its ability to remove malicious content.
Who benefits from keeping it alive
Four distinct groups have an interest in .su continuing to operate.
State actors benefit from jurisdictional ambiguity. When a criminal site runs on .su, which authority has regulatory competence is genuinely unclear, and that ambiguity has never been urgent to resolve.
Cybercriminals benefit from lax enforcement. When Russian authorities tightened oversight of .ru around 2011–2012, operators migrated to .su in volume; the zone’s population doubled in 2011 and again in 2012. Botnet command-and-control, ransomware distribution, credential theft and phishing infrastructure have all made extensive use of it.
Ideological actors benefit from its symbolic weight. The Soviet resonance carries meaning for ultranationalist and Eurasianist networks, and several well-known figures in that space have chosen .su deliberately for their platforms.
Registrars benefit commercially. The zone generates fees, and the incoming verification requirement has itself created a new revenue line in “trusted administrator” services for non-resident holders.
What .su sites actually contain
The ecosystem is more varied than its reputation suggests, which is precisely what makes it difficult to assess at a glance. Our taxonomy covers five categories:
Cybercriminal infrastructure: the most serious documented risk, spanning botnet command-and-control, ransomware payment portals, credential theft and breach-data publishing
Political extremism and influence operations: ideologically motivated content united primarily by hostility to Western liberal institutions
Counterfeit goods, diverted supply chains and brand impersonation: directly relevant to fashion, retail and consumer goods
Unregulated commercial and entertainment content: illegal streaming, gambling platforms, grey-market software
Nostalgic and curated content: minimal risk, maximum symbolic signal
Enforcement is unusually difficult. The .su dispute resolution process is not aligned with standard WIPO procedures, and takedown requests depend on cooperation from Russian-controlled infrastructure operators.
What changes on 1 September 2026
From that date, Federal Law No. 569-FZ requires every administrator of a .ru, .рф or .su domain to verify their identity through Gosuslugi, Russia’s national identification platform. Registration, renewal, transfer, even a DNS change, all of it requires a verified account. Domains that cannot complete verification will not renew.
Roughly 80,000 non-resident clients at a single registrar hold domains they cannot verify without a Russian account, which typically requires physical presence in Russia to create. A trusted-administrator mechanism has been created to bridge that gap, under which a verified entity holds formal administrative responsibility while DNS management and renewal rights stay with the non-resident holder.
The first organisations to show interest in that service were international companies providing intellectual property and digital asset protection to global brands, which tells you that major brands already hold defensive .su registrations, and are now managing a compliance problem attached to them.
What this means for your organisation
Three developments follow predictably from the deadline.
A defensive registration wave by major international brands, formalising .su holdings before the deadline to prevent impersonators taking the names instead.
Criminal infrastructure migration or adaptation. Sophisticated operators will route around verification using shell identities or the trustee mechanism, or move to adjacent jurisdictionally difficult TLDs. Monitoring for that migration is part of the threat picture.
Increased Russian state visibility into the registrant base. For non-resident holders this raises real questions about registration data held in Russian government systems, and warrants legal advice.
The practical question for most organisations is simpler than any of this: do you know whether your brand name is registered in the .su space, and by whom? Most do not.
24/7 Crisis Support through a state of the art Global Security Operations Center.
What is the .su domain?
A country-code top-level domain assigned to the Soviet Union in September 1990. The state dissolved in December 1991; the domain was never decommissioned and remains in active use.
Is .su still active in 2026?
Yes. Over 109,000 domains were active as of June 2026, and ICANN’s projected retirement date for the zone is 2030.
Who controls the .su registry?
Technical Center of Internet LLC, a subsidiary of the Russian state-owned telecommunications operator Rostelecom, has maintained the zone since 2009.
Why is .su considered a security risk?
Jurisdictional ambiguity, limited enforcement capacity and a dispute-resolution process not aligned with standard WIPO procedure make takedowns unusually difficult, which has historically attracted criminal and extremist infrastructure.
What happens to .su domains on 1 September 2026?
Every administrator must verify their identity through Russia’s national ESIA platform. Domains that cannot complete verification will not renew.
Mihaela Vata heads the Business Intelligence Practice department at NSSG, overseeing complex, high-stakes intelligence engagements for domestic and international clients. She manages the firm’s capabilities across Investigations & Due Diligence, Reputational Risk & Crisis Monitoring, as well as Geopolitical & Strategic Intelligence, ensuring that intelligence outputs are closely aligned with business decision-making, risk exposure, and strategic objectives.
With nearly 20 years of experience spanning national security, counter-terrorism, forensic intelligence, and corporate risk advisory, Mihaela brings a rare combination of operational intelligence background and private-sector strategic advisory expertise.
Prior to joining NSSG, she served with the Romanian Intelligence Service, acting as a trusted analyst and advisor on both operational and strategic matters. Her subsequent work in forensic intelligence and AML/CFT analysis in the private sector further strengthened her ability to translate complex geopolitical, regulatory, and security dynamics into actionable insights for corporate leaders. Mihaela is an alumna of the George C. Marshall European Center for Security Studies and holds advanced degrees in National Security Intelligence Management.
