mass.report
Scan Intelligence Report0/100
critical Risk
privnmote.com
https://privnmote.com/
IP
172.67.185.70 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
21 days
HTTP
200 · 24.0s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
KB/IOK Matches (1)Feb 22, 2026, 04:13 AM UTC
Privnote Typosquat Clone (Credential Phish)
privnote-typosquat-clone-credential-phish-effbf276
Privnote
Credential Phishingtechnology | ecommerce | finance | education | cryptocurrency | other · 4/5/2026
Summary
The page at privnmote.com presents a Privnote branding (title and UI) but the domain is a typosquat of privnote.com. The site loads Privnote-like UI and scripts in a SPA-like structure, with a password field present in the static HTML and credential-related flows implied by the UI. The domain is only 21 days old and points to Cloudflare, with a valid SSL certificate issued to privnmote.com. This indicates an impersonation attempt designed to harvest credentials or notes via a Privnote-like interface.
Attack Techniques (5)
Typosquat domain (privnmote.com vs privnote.com)Brand logo/UI loaded from Privnote-like assets and page title impersonating PrivnoteSPA/Vue/React-like dynamic form rendering with credential capture in JS bundlesPassword field present in interface suggesting credential collectionExternal script and asset loading to mimic Privnote, plus Cloudflare-proxied hosting
Indicators of Compromise (7)
▸DOMAIN: privnmote.com (typosquat of privnote.com)
▸PAGE TITLE: 'Privnote - Send notes that will self-destruct after being read'
▸NETWORK REQUESTS: assets/js/browser.js, jquery, fingerprintjs, logo-header.svg
▸STATIC HTML contains a password input field and a dynamic note form despite no static form in HTML
▸SSL cert issued to privnmote.com, valid Jan 31 2026 to May 1 2026
▸Domain age: 21 days (new domain)
▸CLOUDFLARE hosting (IP 172.67.185.70)
Risk AssessmentUsed in abuse reports
High-risk impersonation detected. The domain privnmote.com is a near-identical typosquat of Privnote and uses Privnote branding in the page title and UI, together with a password field and SPA-like credential capture mechanics. The site employs Cloudflare and a recently issued SSL cert, and shows dynamic content likely to render forms via JavaScript. This combination strongly indicates credential/phishing intent targeting Privnote users; immediate takedown and domain suspension are warranted, and hosting providers should block or suspend access to privnmote.com and related subresources. Evidence includes the 21-day-old domain, typosquatted domain name, Privnote branding in title and UI, and network requests loading Privnote-like assets.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API