su-shi[.]bond

This domain, su-shi.bond, was registered through Dynadot LLC on March 04 2026 and immediately resolved to the IPv4 address 12.11.10.2, which is announced by AS7018 belonging to AT&T Enterprises, LLC in the United States. The authoritative name servers are ashley.ns.cloudflare.com and denver.ns.cloudflare.com, indicating Cloudflare DNS services. No TLS certificate is presented; attempts to establish an HTTPS connection return no certificate, confirming the site is served only over HTTP. The HTTP response is currently offline, and the domain has been taken offline by its operator.

VirusTotal analysis shows that one of ninety‑four security vendors flagged the domain, and three independent blocklists—PhishDestroy, MetaMask, and SEAL—have already listed it as malicious. The page title returned by the server is the literal string “su‑shi.bond”, providing no additional context about the content or targeted brand. Because the site is not reachable, content‑level indicators such as login forms, credential‑stealing pages, or brand impersonation cannot be confirmed.

The available evidence therefore points to a generic phishing infrastructure that was likely deployed shortly after registration and subsequently shut down. Defenders should continue to deny any network traffic to 12.11.10.2, add su‑shi.bond to URL filtering and DNS sinkhole rules, and monitor for any re‑registration attempts or similar domains using the same name‑server pair. Given the recent creation date and the presence on multiple blocklists, the domain should be treated as high‑risk until a full forensic snapshot confirms its retirement.