su-shi[.]cc

Analysis of the domain su-shi.cc, registered on March 4 2026 through Dynadot LLC, indicates that the site was taken offline prior to the assessment date of July 24 2026. The domain resolves to the IPv4 address 12.11.10.2, which belongs to AS7018 operated by AT&T Enterprises, LLC and is geolocated in the United States. DNS resolution is handled by Cloudflare, as evidenced by the authoritative name servers ashley.ns.cloudflare.com and denver.ns.cloudflare.com. No TLS certificate was observed for the domain, implying that any web service would have been delivered over plain HTTP, a characteristic often exploited by credential‑stealing campaigns. Reputation checks reveal that su-shi.cc appears on three independent security blocklists, specifically PhishDestroy, MetaMask, and SEAL.

VirusTotal scans returned three positive detections out of ninety‑four submitted engines, confirming that at least a subset of security vendors have identified malicious behavior associated with the host. The page title returned by the HTTP response is simply “su-shi.cc”, providing no additional context about the intended impersonated brand or service. Because the site is currently offline, direct content analysis is not possible, and the exact phishing lure or targeted brand cannot be confirmed. The absence of a valid SSL certificate, combined with the presence on multiple phishing‑related blocklists and the modest VirusTotal detection count, suggests that the domain was likely used for credential harvesting or similar generic phishing operations. However, without live content or a captured landing page, the precise attack vector remains uncertain.

Defenders should continue to block traffic to 12.11.10.2 and to the domain su-shi.cc at the DNS and network layers. Updating web‑filter and endpoint protection rules to include the observed blocklist entries will reduce exposure.