by @Michel gaschet #whitehat ( Mailto : me[at]michelgaschet.gp )
In a recent analysis of the leaked Russian TLDs DNS root zone, thanks to the TLDR Project, i've discovered in the .su zone multiple domains (crdsu.su, cardmafia.su and -special case- codeshop.su) who was using "ns.spamhaus.su" as Primary and Secondary NS. To avoid any malicious use, and - it must be admitted - for fun, I registered the domain (9 € on nic.ru :D ) and added it to my dedicated kimsufi server.
crdsu.su was registered on 2015-10-29T14:11:45Z and expire on 2017-10-29T14:11:45Z
cardmafia.su on 2016-06-05T00:59:20Z and expire on 2018-06-05T00:59:20Z
codeshop.su has... already expired on 2017-06-29T20:42:27Z and moved to nic.ru expired NS (expirepages-kiae-.nic.ru)