su-shi[.]sbs

This domain, su-shi.sbs, is identified as a credential harvesting phishing infrastructure targeting users through deceptive login interfaces. Analysis confirms the domain is currently offline, though prior activity indicates an intent to capture authentication credentials via fraudulent web forms. No specific brand impersonation has been conclusively linked, but the generic nature of the page title and domain suggests broad targeting across multiple services or platforms. Infrastructure analysis reveals the domain was registered on March 04, 2026, through Dynadot LLC, a registrar frequently observed in phishing operations. The domain resolved to the IP address 12.11.10.2, which may serve as a hosting node for additional malicious content. Security telemetry indicates the domain was flagged by 4 of 95 vendors on VirusTotal, with detections spanning heuristic analysis and behavioral signatures. Additionally, the domain appears on three independent security blocklists, including entries from high-confidence threat intelligence feeds. No associated SSL certificates or subdomains were observed during the investigation. Current assessment places the domain in an offline state, though the infrastructure remains registered and could be reactivated. Organizations are advised to implement DNS-based blocking for su-shi.sbs and its resolved IP address 12.11.10.2 at the perimeter level. Security teams should review logs for prior connections to the domain or IP, particularly from endpoints exhibiting anomalous authentication attempts. Given the domain's creation date in 2026, temporal analysis suggests potential future reuse; continuous monitoring of related infrastructure is recommended. End users should be educated on recognizing credential harvesting tactics, particularly those involving generic or misspelled domain names.