# Is .SU a lawless offshore haven? What jurisdiction applies Canonical URL: https://xuid.ru/blog/is-su-lawless-offshore-haven/ Language: en Published: 2026-11-14. Category: Protection. .SU is offshore from the US and EU, but not lawless. See the Russian rules for suspending .SU domains, and what Full Bulletproof covers and doesn't. .SU is offshore in one sense and onshore in another. From the US or EU, it is a domain whose registry, registrars and dispute process are all somewhere else. From Russia, it is [part of the national domain zone](https://ripn.su/en/news/statement-on-su-cctld-status/), alongside .RU and .РФ, and runs under Government rules. Those rules require a domain to be suspended when state agencies demand it. So .SU is not lawless. It follows a different legal system, and choosing it well means understanding which one. ## Where the "lawless" reputation comes from The extension's reputation grew as security researchers and journalists tracked cybercrime forums and carding shops using .SU names. The association hasn't disappeared. In January 2026, Krebs on Security reported that the command domain of the Kimwolf botnet, a .su name, [spent several weeks topping Cloudflare's chart](https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/) of most-requested domains. Abuse on a domain is not the same as an absence of rules, though, and the current rules are detailed. ## The rules that apply to .SU today Since 1 September 2026, .SU, .RU and .РФ registrations follow Russian Government [Decree No. 1119](http://publication.pravo.gov.ru/document/0001202609010015), which runs to 2032. RIPN, the .SU registry, publishes [its own copy](https://ripn.su/bitrix/templates/veonix/assets/file/rules_su_2026.pdf). **Clause 54** requires a registrar to suspend a domain's delegation: - on a decision of a state body carrying out operational investigations - on a demand from Roskomnadzor, the national internet regulator, about misuse of personal data or a site restricted under Russia's information law - on a request from the national computer-incident centre about computer attacks **Clause 56** covers phishing, unauthorised access, malicious code and child sexual abuse material. **Clause 60** says the coordinator and registrar are not liable for losses caused by a suspension. **Clause 74** lets a registration be cancelled for: - a registration made in breach of the rules - failed identification - a court act - termination of the contract **Identification.** Clauses 12 and 28 require the registrant to be identified through ESIA, the state services identity system, at registration and every year after. RIPN's published [stop-list policy](https://ripn.su/bitrix/templates/veonix/assets/file/stoplist_su.pdf) adds a notice route: approved "competent organisations" can ask registrars to suspend domains used for phishing, malware or botnet control. RIPN [publishes the list](https://ripn.su/bitrix/templates/veonix/assets/file/comp_org.pdf), which includes: - Roskomnadzor - the national computer-incident centre - the Bank of Russia - security companies such as BI.ZONE, Dr.Web and F6 Content rules apply too. Russia's information law, [149-FZ](https://www.consultant.ru/document/cons_doc_LAW_61798/), maintains a register of restricted sites, and Decree 1119 ties .SU suspensions to that law. The rules apply to every .SU domain, wherever its owner lives. ## What "offshore" honestly gets you Against US and EU legal processes, .SU's position is real. - **No US registry or registrar.** The usual US seizure route through Verisign or a US registrar has no counterpart. See [Can US authorities seize a .SU domain?](https://xuid.ru/blog/su-domains-us-jurisdiction/) - **No EU registry or registrar,** and no recorded EU action against the .SU registry. See [Do EU rules apply to .SU domains?](https://xuid.ru/blog/su-domains-eu-rules/) - **No ICANN contract and no UDRP.** A trademark claimant needs a Russian court, because the registry [does not decide disputes itself](https://ripn.su/bitrix/templates/veonix/assets/file/lawsuit_su.pdf). See [Is .SU outside ICANN?](https://xuid.ru/blog/is-su-outside-icann/) What you get is a different jurisdiction, not freedom from jurisdiction. For a lawful project whose owner wants its registration outside US and EU companies, that difference can be useful. It does not change which laws apply to you, or to activity aimed at people in a given country. For a project that breaks Russian law, .SU is a poor choice: the registry acts on Russian requests directly. ## Where Full Bulletproof fits xUID's Full Bulletproof Protection adds $8,000/year to the domain price, a total of $8,075/year for .SU. It includes an exclusive registration identity and high-priority support. xUID handles abuse reports and complaints, and your domain stays online within your service agreement. That protection works at xUID's level. It does not override the registry rules above: a court act or a state request under Decree 1119 is applied at registry and registrar level. Treat Full Bulletproof as complaint handling for a domain that stays within those rules, not as immunity. The [.SU Bulletproof page](https://xuid.ru/domains/su/bulletproof/) sets out what the service includes. Hosting is separate. If you need a protected server as well, compare [xUID hosting](https://xuid.ru/hosting/) on its own terms. ## Choosing .SU with clear expectations .SU is a good fit if you want: - a short, generic-in-search domain - registration through a trustee, without handing over your identity - a registry outside US and EU companies, with court-based disputes instead of UDRP It is not a fit if you need to be beyond every government's reach. No top-level domain offers that. Base .SU registration with a shared trustee costs $75/year, and Private Identity totals $825/year. Read [Why choose .SU for an anonymous domain?](https://xuid.ru/blog/why-su-anonymous-domain/) for the full comparison, then [search .SU names](https://xuid.ru/domains/su/).