mass.report
Scan Intelligence Report0/100
critical Risk
privnoke.com
https://privnoke.com/notes/
IP
82.221.141.61 · Icenetworks Ltd
Location
Reykjavik, Iceland
Domain Age
0 days ⚠
HTTP
200 · 13.8s
SSL
Valid· R13, Let's Encrypt, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
25/31
Status
completed
✓ avg✓ avast✓ bitdefender✓ brightcloud✓ norton✓ polyswarm✓ sophos✓ yandex✓ chainpatrol✓ microsoft✓ eset✓ drweb⟳ cisa⟳ apple⟳ apwg⟳ openphish⟳ emsisoft⟳ isitphish✓ urlquery✓ spamhaus✓ virustotal✓ fortiguard✓ urlscan✓ netcraft✓ phishreport✓ phishtank✓ urlabuse✓ mcafee✓ google✓ threatyeti✓ kaspersky
KB/IOK Matches (1)+1 similar hiddenApr 2, 2026, 11:17 PM UTC
Privnote Clone Kit
privnote-clone-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
Privnote
Payment FraudCryptocurrency · 4/5/2026
Summary
This page is a clone of Privnote built from a known phishing kit. It reproduces the exact Privnote UI structure and branding on a non-official domain. These clones are used for cryptocurrency theft — they intercept or replace wallet addresses in notes that victims share, sometimes exfiltrating data via Telegram webhooks. The domain is not affiliated with the legitimate privnote.com.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸Distinctive asset clues: index-DQcemr1b.js, HomeView-CK5P9goT.js, index-CKBtSWmB.css, privnote-logo.svg, privnote-page-flip-30.png.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 9
Hosts: 1
Domains: 1
Attack Techniques (3)
Privnote brand impersonation (title, logo, full UI clone)Known clone kit DOM structure (new_note, encrypt_note, note_raw element IDs)Cryptocurrency address interception or backend swapping
Indicators of Compromise (3)
▸Page title matches Privnote branding
▸Clone kit HTML structure with exact Privnote element IDs
▸Privnote logo served from non-official domain
Risk AssessmentUsed in abuse reports
This domain serves a known Privnote clone kit identified by its HTML structure and branding assets. These kits are deployed across many typosquat domains and are used for cryptocurrency theft — typically by intercepting or replacing wallet addresses in shared notes. The kit is not affiliated with the legitimate privnote.com service. This is a confirmed malicious deployment that warrants immediate domain suspension and hosting takedown.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API