mass.report
Scan Intelligence Report0/100
critical Risk
privnvte.com
https://privnvte.com/privnote/
IP
104.21.84.195 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
0 days ⚠
HTTP
200 · 20.6s
SSL
Valid· E8, Let's Encrypt, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
26/26
Status
partial
✓ apwg✓ apple✓ emsisoft✓ openphish✓ cisa✓ sophos✓ spamhaus✓ phishreport✓ netcraft✓ urlscan✓ virustotal✓ urlquery✓ phishtank✓ microsoft✓ yandex✓ eset✓ norton✓ brightcloud✓ urlabuse✓ avast✓ bitdefender✓ avg✓ mcafee✓ threatyeti✓ fortiguard✓ google
KB/IOK Matches (1)+1 similar hiddenFeb 23, 2026, 11:33 AM UTC
Privnote Clone Kit
privnote-clone-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
Privnote
Payment FraudCryptocurrency · 4/5/2026
Summary
This page is a clone of Privnote built from a known phishing kit. It reproduces the exact Privnote UI structure and branding on a non-official domain. These clones are used for cryptocurrency theft — they intercept or replace wallet addresses in notes that victims share, sometimes exfiltrating data via Telegram webhooks. The domain is not affiliated with the legitimate privnote.com.
Attack Techniques (3)
Privnote brand impersonation (title, logo, full UI clone)Known clone kit DOM structure (new_note, encrypt_note, note_raw element IDs)Cryptocurrency address interception or backend swapping
Indicators of Compromise (3)
▸Page title matches Privnote branding
▸Clone kit HTML structure with exact Privnote element IDs
▸Privnote logo served from non-official domain
Risk AssessmentUsed in abuse reports
This domain serves a known Privnote clone kit identified by its HTML structure and branding assets. These kits are deployed across many typosquat domains and are used for cryptocurrency theft — typically by intercepting or replacing wallet addresses in shared notes. The kit is not affiliated with the legitimate privnote.com service. This is a confirmed malicious deployment that warrants immediate domain suspension and hosting takedown.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API