mass.report
Scan Intelligence Report0/100
critical Risk
pmivnote.com
https://pmivnote.com/privnote/?utm_source=google&utm_medium=cpc&utm_campaign=g&utm_content=799034802153&utm_term=privnote&gad_source=1&gad_campaignid=23423181531&gbraid=0AAAABCM-2EyxecLGdr34RW0TyweEwhFmp&gclid=EAIaIQobChMIwO2P6q6IkwMV0pWDBx2xVQ1LEAAYAiAAEgL85_D_BwE
IP
178.212.13.26 · Hostland LTD
Location
St Petersburg, Russia
Domain Age
0 days ⚠
HTTP
200 · 42.8s
SSL
Valid· R13, Let's Encrypt, US
Status
COMPLETED
Domain Intelligence: pmivnote.com
Scanned 3 times since Mar 5, 2026, 09:01 AM UTC
✗ Critical (100)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
27/27
Status
completed
✓ apwg✓ openphish✓ spamhaus✓ mcafee✓ avast✓ avg✓ eset✓ sophos✓ microsoft✓ virustotal✓ yandex✓ norton✓ bitdefender✓ brightcloud✓ google✓ apple✓ cisa✓ emsisoft✓ urlquery✓ urlscan✓ phishreport✓ netcraft✓ phishtank✓ urlabuse✓ fortiguard✓ kaspersky✓ threatyeti
KB/IOK Matches (1)+1 similar hiddenMar 5, 2026, 09:13 AM UTC
Privnote Clone Kit
privnote-clone-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
Privnote
Payment FraudCryptocurrency · 4/5/2026
Summary
This page is a clone of Privnote built from a known phishing kit. It reproduces the exact Privnote UI structure and branding on a non-official domain. These clones are used for cryptocurrency theft — they intercept or replace wallet addresses in notes that victims share, sometimes exfiltrating data via Telegram webhooks. The domain is not affiliated with the legitimate privnote.com.
Attack Techniques (3)
Privnote brand impersonation (title, logo, full UI clone)Known clone kit DOM structure (new_note, encrypt_note, note_raw element IDs)Cryptocurrency address interception or backend swapping
Indicators of Compromise (3)
▸Page title matches Privnote branding
▸Clone kit HTML structure with exact Privnote element IDs
▸Privnote logo served from non-official domain
Risk AssessmentUsed in abuse reports
This domain serves a known Privnote clone kit identified by its HTML structure and branding assets. These kits are deployed across many typosquat domains and are used for cryptocurrency theft — typically by intercepting or replacing wallet addresses in shared notes. The kit is not affiliated with the legitimate privnote.com service. This is a confirmed malicious deployment that warrants immediate domain suspension and hosting takedown.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API