mass.report
Scan Intelligence Report0/100
critical Risk
privntoe.com
https://privntoe.com/
IP
172.67.129.183 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
27 days
HTTP
200 · 16.4s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
KB/IOK Matches (1)Feb 22, 2026, 05:27 AM UTC
Privnote Clone Kit (Legacy Bundle)
privnote-clone-kit-legacy-bundle-59366188
Directives: skipAi, skipUnblocker, skipMobileVariant
Privnote
Payment FraudCryptocurrency · 4/5/2026
Summary
This page is a clone of Privnote built from a known phishing kit. The domain serves the same JS/CSS asset bundle seen across many Privnote clone deployments. These clones are typically used for cryptocurrency theft — they intercept or replace wallet addresses in notes that victims share. The domain is not affiliated with the legitimate privnote.com.
Attack Techniques (3)
Privnote brand impersonation (title, logo, UI)Known clone kit asset bundle (legacy.css, legacy.js, common.js, gibberish-aes.js)Cryptocurrency address interception or backend swapping
Indicators of Compromise (3)
▸Page title matches Privnote branding
▸JS/CSS bundle fingerprint matches known Privnote clone kit
▸Privnote logo and page-flip assets served from non-official domain
Risk AssessmentUsed in abuse reports
This domain serves a known Privnote clone kit identified by its asset bundle fingerprint. These kits are deployed across many typosquat domains and are used for cryptocurrency theft — typically by intercepting or replacing wallet addresses in shared notes. The kit is not affiliated with the legitimate privnote.com service. This is a confirmed malicious deployment that warrants immediate domain suspension and hosting takedown.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API