Comment by lifthrasiir

All three references are 10 years old (or only have a secondary reference that is 10 years old). More recent analyses give much more diverse set of TLDs---.ga, .tk, .us, .ru, .ml, .pw and so on [1]. In fact, at this point we should be much more concerned about .us than .su.

[1] https://www.interisle.net/PhishingLandscape2023.pdf#page=18