mass.report
Scan Intelligence Report0/100
high Risk
prlynote.com
https://prlynote.com/notes
IP
172.67.178.61 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
0 days ⚠
HTTP
200 · 14.5s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
prlynote.com
Vendors
30/31
Status
partial
✓ virustotal✓ eset✓ microsoft✓ drweb✓ yandex✓ sophos✓ chainpatrol✓ avast✓ brightcloud✓ polyswarm✓ emsisoft✓ bitdefender✓ avg✗ norton✓ apple✓ apwg✓ cisa✓ urlscan✓ phishtank✓ phishreport✓ spamhaus✓ isitphish✓ urlquery✓ openphish✓ netcraft✓ urlabuse✓ google✓ threatyeti✓ mcafee✓ fortiguard✓ kaspersky
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
prlynote.com
UnknownTechnology · 7/19/2026
Summary
The page presents a note-sharing interface with a self-destruct concept, but the domain prlynote.com is a Typosquat near Privnote (privnote.com). The page visually imitates a note-sharing service and includes a password field, a note textarea, and UI elements resembling Privnote, supported by domain similarity signals and the user-facing branding text. While there is no definitive credential harvesting form observed in static HTML, the combination of typosquatting signals, new domain age (0 days), and Privnote-like assets strongly suggests impersonation risk. The observed network activity includes a POST to a rum endpoint and assets such as privnote-logo.svg, further reinforcing the impersonation cue.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸Canonical stage contains password collection UI.
▸POST targets observed during capture: https://prlynote.com/cdn-cgi/rum?.
▸Distinctive asset clues: email-decode.min.js, v833ccba57c9e4d2798f2e76cebdd09a11778172276447, app.css, privnote-logo.svg, privnote-page-flip-30.png.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 1
Password fields: 3
Late-stage login UI: No
Resource Signals
Resources: 13
Hosts: 2
Domains: 2
Suspicious Endpoints
hxxps://prlynote[.]com/notes/
hxxps://prlynote[.]com/notes/api/send.php
Attack Techniques (3)
Typosquatting / brand impersonation signals (domain similarity to Privnote).Single-page-like credential collection UI with password field present in the page rendering.POST to /cdn-cgi/rum? observed, suggesting data exfiltration or beaconing.
Indicators of Compromise (1)
▸Domain similarity: prlynote.com vs Privnote (privnote.com) — typosquat risk.
Risk AssessmentUsed in abuse reports
The scan indicates strong impersonation signals: domain is a near-match typosquat of Privnote, combined with Privnote-like branding assets (privnote-logo.svg), UI cues, and a password field. Although the page does not show a direct credential submission form in static HTML, the presence of a password field and a self-destruct note interface on a newly issued domain strongly suggests phishing impersonation aimed at harvesting credentials or data. The use of a Cloudflare-provided script and a rum endpoint for POSTs may indicate data exfiltration or beaconing. Given these signals, this appears to be a first-party impersonation abuse with probable credential-dishonest intent.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API