mass.report
Scan Intelligence Report0/100
critical Risk
privacnote.com
http://privacnote.com/notes
IP
62.60.226.244 · Femo IT Solutions Limited
Location
Frankfurt am Main, Germany
Domain Age
4 days ⚠
HTTP
200 · 13.0s
SSL
Valid· R13, Let's Encrypt, US
Status
COMPLETED
Domain Intelligence: privacnote.com
Scanned 2 times since Apr 12, 2026, 11:44 AM UTC
✗ Critical (100)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
30/30
Status
completed
✓ avast✓ bitdefender✓ brightcloud✓ polyswarm✓ eset✓ microsoft✓ yandex✓ avg✓ sophos✓ apple✓ isitphish✓ spamhaus✓ cisa✓ emsisoft✓ apwg✓ threatyeti✓ openphish✓ phishreport✓ drweb✓ urlabuse✓ norton✓ fortiguard✓ netcraft✓ urlquery✓ phishtank✓ virustotal✓ google✓ urlscan✓ mcafee✓ kaspersky
KB/IOK Matches (1)Apr 13, 2026, 06:30 AM UTC
Privnote Clone Kit
privnote-clone-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
Privnote
Payment FraudCryptocurrency · 4/15/2026
Summary
This page is a clone of Privnote built from a known phishing kit. It reproduces the exact Privnote UI structure and branding on a non-official domain. These clones are used for cryptocurrency theft — they intercept or replace wallet addresses in notes that victims share, sometimes exfiltrating data via Telegram webhooks. The domain is not affiliated with the legitimate privnote.com.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸Canonical stage contains password collection UI.
▸Distinctive asset clues: app.css, privnote-logo.svg, privnote-page-flip-30.png.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 1
Password fields: 3
Late-stage login UI: No
Resource Signals
Resources: 9
Hosts: 1
Domains: 1
Suspicious Endpoints
hxxp://privacnote[.]com/notes/
hxxp://privacnote[.]com/notes/api/send.php
Attack Techniques (3)
Privnote brand impersonation (title, logo, full UI clone)Known clone kit DOM structure (new_note, encrypt_note, note_raw element IDs)Cryptocurrency address interception or backend swapping
Indicators of Compromise (3)
▸Page title matches Privnote branding
▸Clone kit HTML structure with exact Privnote element IDs
▸Privnote logo served from non-official domain
Risk AssessmentUsed in abuse reports
This domain serves a known Privnote clone kit identified by its HTML structure and branding assets. These kits are deployed across many typosquat domains and are used for cryptocurrency theft — typically by intercepting or replacing wallet addresses in shared notes. The kit is not affiliated with the legitimate privnote.com service. This is a confirmed malicious deployment that warrants immediate domain suspension and hosting takedown.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API