mass.report
Scan Intelligence Report0/100
critical Risk
privcnote.com
https://privcnote.com/
IP
172.67.204.225 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
6 days ⚠
HTTP
200 · 14.0s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: privcnote.com
Scanned 2 times since Feb 15, 2026, 11:46 PM UTC
✗ Critical (100)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
25/25
Status
completed
✓ openphish✓ cisa✓ apwg✓ emsisoft✓ apple✓ virustotal✓ phishreport✓ spamhaus✓ sophos✓ netcraft✓ urlscan✓ urlquery✓ phishtank✓ mcafee✓ microsoft✓ yandex✓ avg✓ avast✓ eset✓ norton✓ google✓ fortiguard✓ urlabuse✓ brightcloud✓ bitdefender
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Privnote
Credential PhishingTechnology · 4/5/2026
Summary
The site at privcnote.com is a typosquat clone of the legitimate Privnote service (privnote.com). It mimics the branding and functionality of Privnote, allowing users to create self-destructing notes, likely to capture sensitive information such as passwords and email addresses. The domain is only one character different from the real domain, indicating a clear intent to deceive users.
Attack Techniques (5)
Typosquat domain (privcnote.com → privnote.com)Cloned UI with identical branding and functionalityDynamic credential capture via JavaScriptPassword input fields for note encryptionPOST requests to potential exfiltration endpoints
Indicators of Compromise (5)
▸Domain: privcnote.com
▸Page title: 'Privnote - Send notes that will self-destruct after being read'
▸External script: https://privcnote.com/assets/js/browser.js
▸POST request to: https://privcnote.com/browser/check
▸SSL certificate issued on: Feb 9, 2026
Risk AssessmentUsed in abuse reports
The domain privcnote.com is a newly registered typosquat of the legitimate Privnote service, differing by only one character. The page title clearly references Privnote, and the site mimics its functionality, suggesting an intent to deceive users into providing sensitive information. The domain is only 6 days old, and the SSL certificate was issued recently, further indicating a high risk of phishing activity. Immediate action is required to mitigate potential user harm.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API