.SU is offshore in one sense and onshore in another. From the US or EU, it is a domain whose registry, registrars and dispute process are all somewhere else. From Russia, it is part of the national domain zone, alongside .RU and .РФ, and runs under Government rules. Those rules require a domain to be suspended when state agencies demand it.

So .SU is not lawless. It follows a different legal system, and choosing it well means understanding which one.

Where the “lawless” reputation comes from

The extension’s reputation grew as security researchers and journalists tracked cybercrime forums and carding shops using .SU names.

The association hasn’t disappeared. In January 2026, Krebs on Security reported that the command domain of the Kimwolf botnet, a .su name, spent several weeks topping Cloudflare’s chart of most-requested domains. Abuse on a domain is not the same as an absence of rules, though, and the current rules are detailed.

The rules that apply to .SU today

Since 1 September 2026, .SU, .RU and .РФ registrations follow Russian Government Decree No. 1119, which runs to 2032. RIPN, the .SU registry, publishes its own copy.

Clause 54 requires a registrar to suspend a domain’s delegation:

  • on a decision of a state body carrying out operational investigations
  • on a demand from Roskomnadzor, the national internet regulator, about misuse of personal data or a site restricted under Russia’s information law
  • on a request from the national computer-incident centre about computer attacks

Clause 56 covers phishing, unauthorised access, malicious code and child sexual abuse material.

Clause 60 says the coordinator and registrar are not liable for losses caused by a suspension.

Clause 74 lets a registration be cancelled for:

  • a registration made in breach of the rules
  • failed identification
  • a court act
  • termination of the contract

Identification. Clauses 12 and 28 require the registrant to be identified through ESIA, the state services identity system, at registration and every year after.

RIPN’s published stop-list policy adds a notice route: approved “competent organisations” can ask registrars to suspend domains used for phishing, malware or botnet control. RIPN publishes the list, which includes:

  • Roskomnadzor
  • the national computer-incident centre
  • the Bank of Russia
  • security companies such as BI.ZONE, Dr.Web and F6

Content rules apply too. Russia’s information law, 149-FZ, maintains a register of restricted sites, and Decree 1119 ties .SU suspensions to that law. The rules apply to every .SU domain, wherever its owner lives.

What “offshore” honestly gets you

Against US and EU legal processes, .SU’s position is real.

What you get is a different jurisdiction, not freedom from jurisdiction. For a lawful project whose owner wants its registration outside US and EU companies, that difference can be useful. It does not change which laws apply to you, or to activity aimed at people in a given country. For a project that breaks Russian law, .SU is a poor choice: the registry acts on Russian requests directly.

Where Full Bulletproof fits

xUID’s Full Bulletproof Protection adds $8,000/year to the domain price, a total of $8,075/year for .SU. It includes an exclusive registration identity and high-priority support. xUID handles abuse reports and complaints, and your domain stays online within your service agreement.

That protection works at xUID’s level. It does not override the registry rules above: a court act or a state request under Decree 1119 is applied at registry and registrar level. Treat Full Bulletproof as complaint handling for a domain that stays within those rules, not as immunity. The .SU Bulletproof page sets out what the service includes.

Hosting is separate. If you need a protected server as well, compare xUID hosting on its own terms.

Choosing .SU with clear expectations

.SU is a good fit if you want:

  • a short, generic-in-search domain
  • registration through a trustee, without handing over your identity
  • a registry outside US and EU companies, with court-based disputes instead of UDRP

It is not a fit if you need to be beyond every government’s reach. No top-level domain offers that.

Base .SU registration with a shared trustee costs $75/year, and Private Identity totals $825/year. Read Why choose .SU for an anonymous domain? for the full comparison, then search .SU names.

Anonymous .RU domains $50/year. .SU domains $75/year.

Compare domain options