mass.report
Scan Intelligence Report0/100
medium Risk
privnote.me
https://privnote.me/
IP
37.27.38.192 · Hetzner Online GmbH
Location
Helsinki, Finland
Domain Age
—
HTTP
200 · 14.6s
SSL
Valid· E7, Let's Encrypt, US
Status
COMPLETED
Domain Intelligence: privnote.me
Scanned 2 times since Feb 22, 2026, 03:58 AM UTC
⚠ Medium (50)
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Privnote
Credential Phishingtechnology | ecommerce | finance | information_security · 4/5/2026
Summary
The page at privnote.me presents itself as Privnote (Privnoted branding in title and header) but the domain is privnote.me, which impersonates Privnote. The SPA-like page loads Privnote branding assets (privnote-logo.svg) and related scripts, and a password field is present in the UI, indicating credential collection via a JavaScript-rendered form. The SSL certificate is recent and issued to privnote.me, with domain name matching the Privnote branding cues, signaling a high likelihood of credential harvesting.
Attack Techniques (5)
Domain impersonation with brand name in URL (privnote.me) and page branding (Privnote logo and text) conflicting with legitimate Privnote domainSingle-Page Application (SPA) dynamic credential capture via external JS bundles (app.js, common.js)Brand logo and UI elements loaded from the phishing domain (privnote-me assets) suggesting clone of Privnote interfacePassword field present in UI despite static HTML lacking forms, indicating runtime form rendering to collect credentialsSSL certificate issued recently (Let's Encrypt) for a new domain, increasing plausibility of a rapid-setup phishing site
Indicators of Compromise (5)
▸DOMAIN: privnote.me (potential impersonation of Privnote)
▸Network requests loading /img/privnote-logo.svg and /js/app.js from privnote.me
▸Page title and header text reference Privnote (Privnoted branding in title: 'Privnoted - Send Self-Destructing Encrypted Notes Online Free')
▸Password input field present in UI
▸SSL certificate issued Feb 15 2026 for privnote.me (valid through May 16 2026)
Risk AssessmentUsed in abuse reports
High risk: The domain name suggests Privnote impersonation, with page title and header reinforcing Privnote branding. The site delivers dynamic JavaScript assets (SPA) and contains a password input, indicating credential capture capabilities. The SSL cert is newly issued for a brand-mimicking domain, and the IP/name resolution/hosting (Hetzner, Helsinki) combined with privacy-protected WHOIS increases suspicion. This is consistent with a phishing page designed to harvest user credentials under the guise of Privnote, warranting urgent remediation and takedown actions.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API