notary-ledger[.]com

This domain, notary-ledger.com, is flagged for brand impersonation targeting Ledger, a well-known cryptocurrency hardware wallet provider. Analysis indicates the site mimics legitimate Ledger services, likely to deceive users into disclosing sensitive information or transferring cryptocurrency to attacker-controlled wallets. The threat type is classified as brand impersonation, with no direct evidence of a crypto drainer kit at this stage, though further investigation is warranted given the domain's context and target audience.

Technical indicators reveal a VirusTotal detection rate of 3/95 security vendors, suggesting limited but notable recognition of malicious intent. The domain was registered on May 3, 2024, through Porkbun LLC, and resolves to the IP address 76.76.21.21, hosted by Vercel, Inc. in the United States. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility. The page title, 'Notary Ledger,' further corroborates the impersonation attempt, as it closely resembles legitimate Ledger branding.

As of the latest assessment, the domain remains active, posing an ongoing risk to users. Response actions include blocking the domain across security platforms and monitoring for further malicious activity. The remaining risk is classified as high due to the domain's active status, low detection rate on VirusTotal, and direct targeting of cryptocurrency users. Users are advised to verify domain authenticity through official Ledger channels, avoid interacting with unsolicited communications, and employ browser-based security extensions to block known malicious domains. Infrastructure analysis reveals the use of a common hosting provider, which may facilitate rapid takedowns but also allows for quick redeployment of malicious sites.