mass.report
Scan Intelligence Report0/100
high Risk
privnote.co
https://privnote.co/
IP
185.112.147.56
Location
Reykjavik, Iceland
Domain Age
—
HTTP
200 · 34.6s
SSL
Valid· R12, Let's Encrypt, US
Status
COMPLETED
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Privnote
Credential PhishingTechnology · 4/5/2026
Summary
The site at privnote.co is impersonating the legitimate Privnote service (privnote.com). It features a password input field and a UI that mimics the original service, likely to capture user credentials. The domain name closely resembles the official brand, indicating a phishing attempt.
Attack Techniques (5)
Domain impersonation (privnote.co → privnote.com)Cloned UI elements that replicate Privnote's functionalityPassword input field present for credential harvestingExternal scripts loaded from the same domain to maintain appearanceBrand logo loaded from the same domain
Indicators of Compromise (5)
▸Domain: privnote.co
▸Page title: 'PrivateNote - Send notes that will self-destruct after being read'
▸Password field detected in the HTML source
▸External script: https://privnote.co/assets/js/lib/gibberish-aes.js
▸Brand logo: https://privnote.co/assets/img/privnote-logo.svg
Risk AssessmentUsed in abuse reports
The domain privnote.co is a clear phishing attempt, closely resembling the legitimate Privnote service (privnote.com). The page title directly references the original service, and the presence of a password input field raises significant concerns regarding credential harvesting. Additionally, the domain is new and uses a free SSL certificate, further indicating malicious intent. Immediate action is required to suspend this domain to prevent user exploitation.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API