mass.report
Scan Intelligence Report0/100
high Risk
priveote.com
https://priveote.com/privnote/
IP
104.21.51.87 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
0 days ⚠
HTTP
200 · 77.1s
SSL
Valid· WE1, Google Trust Services, US
Status
FAILED
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Privnote
Credential PhishingTechnology · 4/5/2026
Summary
The site at priveote.com is a typosquat clone of the legitimate Privnote service (privnote.com). It uses a similar page title and URL path to impersonate Privnote, likely to capture user credentials through a dynamically rendered interface. The presence of an iframe loading content from a suspicious domain further indicates malicious intent.
Attack Techniques (4)
Typosquat domain (priveote.com → privnote.com)Cloned SPA with identical UI elementsIframe loading content from a malicious domain (prlvnot.icu)Brand logo and title impersonation
Indicators of Compromise (4)
▸Domain: priveote.com
▸Iframe source: https://prlvnot.icu/AdQwtgbj
▸Page title: 'Privnote - Self-destructing notes'
▸Network request to: https://prlvnot.icu/static-58c8928/style/legacy/privnote-logo.svg
Risk AssessmentUsed in abuse reports
The domain priveote.com is a newly registered typosquat of the legitimate Privnote service, created just hours ago. The page title and URL path clearly reference Privnote, indicating an intent to impersonate the brand. Additionally, the site loads an iframe from a suspicious domain (prlvnot.icu), which is likely used for credential harvesting. Immediate action is required to mitigate the risk of user data compromise.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API