mass.report
Scan Intelligence Report0/100
critical Risk
pruvnote.com
https://pruvnote.com/
IP
104.21.45.151 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
28 days
HTTP
200 · 30.8s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
KB/IOK Matches (1)+1 similar hiddenFeb 26, 2026, 02:16 AM UTC
Privnote Clone Kit
privnote-clone-kit-legacy-bundle
Directives: skipAi, skipUnblocker, skipMobileVariant
Privnote
Payment FraudCryptocurrency · 4/5/2026
Summary
This page is a clone of Privnote built from a known phishing kit. The domain serves the same JS/CSS asset bundle seen across many Privnote clone deployments. These clones are used for cryptocurrency theft — they intercept or replace wallet addresses in notes that victims share, sometimes exfiltrating data via Telegram webhooks. The domain is not affiliated with the legitimate privnote.com.
Attack Techniques (4)
Privnote brand impersonation (title, logo, UI)Known clone kit asset bundle fingerprintCryptocurrency address interception or backend swappingTelegram webhook exfiltration (telegram_notify.js)
Indicators of Compromise (3)
▸Page title matches Privnote branding
▸JS/CSS bundle fingerprint matches known Privnote clone kit
▸Privnote logo served from non-official domain
Risk AssessmentUsed in abuse reports
This domain serves a known Privnote clone kit identified by its asset bundle fingerprint. These kits are deployed across many typosquat domains and are used for cryptocurrency theft — typically by intercepting or replacing wallet addresses in shared notes. The kit is not affiliated with the legitimate privnote.com service. This is a confirmed malicious deployment that warrants immediate domain suspension and hosting takedown.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API