mass.report
Scan Intelligence Report0/100
critical Risk
privovte.com
https://privovte.com/notes/
IP
62.60.226.244 · Femo IT Solutions Limited
Location
Frankfurt am Main, Germany
Domain Age
3 days ⚠
HTTP
200 · 14.5s
SSL
Valid· YR2, Let's Encrypt, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
privnote (likely typosquat on privovte.com)
Vendors
27/31
Status
partial
✓ avast✓ chainpatrol✓ bitdefender✓ eset✗ norton✗ threatyeti✗ yandex✓ microsoft✓ sophos✗ brightcloud✓ polyswarm✓ avg✓ apple✓ openphish✓ emsisoft✓ cisa✓ isitphish✓ apwg✓ urlquery✓ netcraft✓ virustotal✓ spamhaus✓ phishreport✓ urlscan✓ phishtank✓ urlabuse✓ kaspersky✓ drweb✓ mcafee✓ google✓ fortiguard
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
privnote (likely typosquat on privovte.com)
Credential Phishingtechnology | finance | ecommerce | other · 7/19/2026
Summary
The page on privovte.com/notes presents a note-sharing UI that visually clones Privnote branding (logo assets named privnote, page mentions self-destruct notes). Domain intelligence shows a typosquat proximity to Privnote (privovte vs privnote) and a very new domain (3 days old). The page includes a password field and an endpoint hint (notes/api/send.php) that could be used for data exfiltration. All signs point to impersonation attempts rather than a legitimate Privnote site, suggesting credential collection or data harvesting potential.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸Canonical stage contains password collection UI.
▸Distinctive asset clues: app.css, privnote-logo.svg, privnote-page-flip-30.png.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 1
Password fields: 3
Late-stage login UI: No
Resource Signals
Resources: 8
Hosts: 1
Domains: 1
Suspicious Endpoints
hxxps://privovte[.]com/notes/
hxxps://privovte[.]com/notes/api/send.php
Attack Techniques (5)
Brand impersonation via typosquatted domain (privovte.com)Brand-resembling UI assets (privnote-logo.svg, privnote-page-flip-30.png)Presence of password input fields and a credential-collection UISuspicious endpoint under same domain (notes/api/send.php) for data exfiltrationNew domain with valid Let's Encrypt certificate (short validity window) signaling recent setup
Indicators of Compromise (7)
▸Domain intelligence shows TYPOSQUAT DETECTED: privovte is 2 characters away from privnote
▸SSL certificate issued 3 days ago by Let's Encrypt with privovte.com subject
▸Assets referencing Privnote branding (privnote-logo.svg, privnote-page-flip-30.png)
▸Password input field present in HTML (passwordInputCount: 3; hasPasswordField: true)
▸Network endpoint https://privovte.com/notes/api/send.php observed
▸New domain age: 3 days
▸IP resolution to a German hosting entity (Femo IT Solutions Limited)
Risk AssessmentUsed in abuse reports
The scan indicates a high likelihood of impersonation involving Privnote branding on a typosquatted, newly-registered domain. Visual assets and page title align with Privnote’s concept of self-destructing notes, yet the hostname privovte.com is not Privnote’s official domain. The presence of a password field and a suspicious API endpoint heighten the risk of credential collection or data leakage. Given these indicators, this domain should be treated as abusive impersonation and blocked until provenance is clarified.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API