mass.report
Scan Intelligence Report0/100
critical Risk
privgnote.com
https://privgnote.com/
IP
104.21.25.237 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
10 days
HTTP
200 · 13.9s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
25/25
Status
completed
✓ norton✓ brightcloud✓ emsisoft✓ sophos✓ phishreport✓ cisa✓ apwg✓ eset✓ yandex✓ phishtank✓ netcraft✓ openphish✓ spamhaus✓ urlquery✓ urlscan✓ apple✓ mcafee✓ virustotal✓ microsoft✓ avg✓ avast✓ fortiguard✓ google✓ bitdefender✓ urlabuse
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Privnote
Credential PhishingTechnology · 4/5/2026
Summary
The site at privgnote.com is a typosquat clone of the legitimate Privnote service (privnote.com). It mimics the Privnote interface and functionality, likely to capture user notes and credentials. The domain is only one character different from the official site, indicating a clear intent to deceive users.
Attack Techniques (5)
Typosquat domain (privgnote.com → privnote.com)Cloned UI with identical branding and functionalityDynamic credential capture via JavaScriptPassword input fields for note encryptionPOST requests to potential exfiltration endpoints
Indicators of Compromise (5)
▸Domain: privgnote.com
▸Page title: 'Privnote - Send notes that will self-destruct after being read'
▸External script loading from privgnote.com
▸POST request to /browser/check
▸Password fields for note encryption
Risk AssessmentUsed in abuse reports
The domain privgnote.com is a clear impersonation of the legitimate Privnote service, differing by only one character. The page title directly references Privnote, and the site replicates its functionality, including dynamic credential capture mechanisms. The domain is newly registered (10 days old) and hosted on Cloudflare, raising additional red flags. Immediate action is required to mitigate potential user data compromise.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API