mass.report
Scan Intelligence Report0/100
high Risk
privuote.com
https://privuote.com/privnote/
IP
172.67.216.193 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
1 day ⚠
HTTP
200 · 18.4s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: privuote.com
Scanned 3 times since Feb 12, 2026, 10:44 PM UTC
⚠ High (65)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
25/25
Status
completed
✓ urlquery✓ apple✓ openphish✓ norton✓ netcraft✓ sophos✓ apwg✓ virustotal✓ urlscan✓ phishtank✓ eset✓ emsisoft✓ cisa✓ mcafee✓ avast✓ spamhaus✓ phishreport✓ google✓ microsoft✓ yandex✓ fortiguard✓ avg✓ brightcloud✓ urlabuse✓ bitdefender
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Privnote
Credential PhishingTechnology · 4/5/2026
Summary
The site at privuote.com is a typosquat clone of the legitimate Privnote service (privnote.com). It uses a similar page title and URL path to impersonate Privnote, likely to capture user notes or credentials. The domain is only one character different from the real domain, indicating a phishing attempt.
Attack Techniques (5)
Typosquat domain (privuote.com → privnote.com)Brand name in URL path (/privnote/)Cloned UI elements mimicking Privnote's interfaceJavaScript likely rendering forms dynamically for credential captureBrand logo loaded from the same domain
Indicators of Compromise (5)
▸Domain: privuote.com
▸Page title: 'Privnote - Self-destructing notes'
▸URL path: '/privnote/'
▸JavaScript asset: '/privnote/assets/index-Ij7PN6mq.js'
▸Logo asset: '/privnote/privnote-logo.svg'
Risk AssessmentUsed in abuse reports
The domain privuote.com is a newly registered typosquat of the legitimate Privnote service, differing by only one character. The page title and URL path both reference Privnote, indicating clear intent to impersonate the brand. Additionally, the SSL certificate was issued just one day ago, further raising the risk profile of this domain. Immediate action is warranted to prevent potential credential theft.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API