mass.report
Scan Intelligence Report0/100
high Risk
primvote.com
https://primvote.com/privnote
IP
172.67.166.170 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
0 days ⚠
HTTP
200 · 11.9s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: primvote.com
Scanned 3 times since Feb 17, 2026, 11:04 AM UTC
⚠ High (71)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
25/26
Status
partial
✓ microsoft✓ apwg✓ cisa✓ netcraft✓ apple✓ spamhaus✓ emsisoft✓ sophos✓ phishtank✓ phishreport✓ virustotal✓ mcafee✓ eset✓ urlquery✓ openphish✓ avg✓ avast✓ bitdefender✓ fortiguard✓ norton✓ brightcloud✓ urlscan✗ threatyeti✓ urlabuse✓ yandex✓ google
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Privnote
Credential PhishingTechnology · 4/5/2026
Summary
The site at primvote.com is a typosquat clone of the legitimate Privnote service (privnote.com). It mimics the Privnote interface, allowing users to create self-destructing notes, likely to capture sensitive information. The domain is only two characters different from the real domain, indicating a clear intent to deceive users.
Attack Techniques (4)
Typosquat domain (primvote.com → privnote.com)Cloned SPA with identical UI elementsBrand logo loaded from the same domainDynamic form rendering via JavaScript likely for credential capture
Indicators of Compromise (5)
▸Domain: primvote.com
▸Page title: Privnote - Self-destructing notes
▸Network request for logo: /privnote/privnote-logo.svg
▸JavaScript bundle: /privnote/assets/index-Ij7PN6mq.js
▸POST request to /cdn-cgi/rum?
Risk AssessmentUsed in abuse reports
The domain primvote.com is a newly registered typosquat of the legitimate Privnote service, created just today. The page title and URL path both reference Privnote, indicating clear intent to impersonate the brand. Additionally, the site loads brand assets and has a newly issued SSL certificate, further raising the risk profile. Immediate action is required to mitigate potential user harm.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API