mass.report
Scan Intelligence Report0/100
critical Risk
prvinote.com
https://prvinote.com/
IP
104.21.6.5 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
27 days
HTTP
200 · 19.6s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: prvinote.com
Scanned 2 times since Feb 22, 2026, 04:44 AM UTC
✗ Critical (100)
KB/IOK Matches (1)+1 similar hidden—
Privnote Clone Kit
privnote-clone-kit-legacy-bundle
Directives: skipAi, skipUnblocker, skipMobileVariant
Privnote
Credential Phishingtechnology | ecommerce | finance | cryptocurrency | other · 4/5/2026
Summary
The site at prvinote.com presents a Privnote-branded interface with the page title and header mirroring Privnote. The domain is a typosquat variant of Privnote (prvinote vs privnote) and hosts a login form designed to capture credentials. Visual branding, page title, and UI closely mimic Privnote, while the domain is newly registered and not owned by Privnote’s operators.
Attack Techniques (5)
Typosquat domain (prvinote.com vs privnote.com)Brand logo and UI cloned to resemble PrivnoteLogin form and password field on impersonating pageExternal scripts and assets loaded that imitate Privnote’s frontendSPA-like structure with credential capture potential via client-side form submission
Indicators of Compromise (7)
▸DOMAIN: prvinote.com (typosquatting variant of Privnote)
▸PAGE TITLE: Privnote - Send notes that will self-destruct after being read
▸LOGIN FORM present with password field
▸External script domains include prvinote.com and suspicious third-party domains (clickiocmp.com)
▸SSL certificate valid for prvinote.com, recently issued (2026-01-28), domain age 27 days
▸Favicon/logo path references Privnote branding
▸Network requests include privnote-logo.svg and Privnote-like assets
Risk AssessmentUsed in abuse reports
Scanner detected a typosquat impersonation of Privnote. The domain prvinote.com is newly registered (27 days) and hosts a Privnote-branded UI with a login form, indicating credential collection. Visual branding, page title, and assets mimic Privnote, while the domain does not belong to Privnote. The page uses multiple external scripts and Cloudflare infrastructure, suggesting an attempt to emulate legitimate Privnote functionality and harvest user credentials. This is a clear phishing attempt with credential theft potential and warrants rapid containment.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API