us-notion[.]to

This domain, us-notion.to, is identified as a high-risk generic phishing site designed to impersonate Notion, a widely used productivity platform. Analysis indicates the domain hosts a fraudulent page titled 'Productivity Workflows in 2026 — Clear Desk Journal,' likely intended to deceive users into entering sensitive credentials or downloading malicious content under the guise of legitimate productivity tools. No specific drainer kit signatures were confirmed, but the domain exhibits characteristics consistent with credential harvesting infrastructure. Infrastructure analysis reveals the domain was registered on April 04, 2026, through the Government of Kingdom of Tonga registrar. It resolves to the IP address 158.94.209.181 and uses an SSL certificate issued by Google Trust Services. Security vendor detection on VirusTotal stands at 13 out of 95, while the domain appears on four distinct security blocklists. Gridinsoft assigns a trust score of 0/100, and the domain is actively blocked by MetaMask, PhishDestroy, SEAL, and Maltrail. No Google Safe Browsing (GSB) entries were reported at the time of analysis. As of the latest assessment, us-notion.to has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure remains registered and could be reactivated or repurposed for future malicious campaigns. Organizations are advised to maintain blocklist entries for this domain and its associated IP address, monitor for related phishing themes targeting productivity software, and verify any unexpected communications or links referencing Notion or similar platforms. End users should be educated on recognizing impersonation attempts, particularly those leveraging fake productivity or workflow-related content.