mass.report
Scan Intelligence Report0/100
high Risk
primvote.com
https://primvote.com/privnote/
IP
104.21.16.62 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
2 days ⚠
HTTP
200 · 42.2s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: primvote.com
Scanned 3 times since Feb 17, 2026, 11:04 AM UTC
⚠ High (71)
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Privnote
Credential PhishingTechnology · 4/5/2026
Summary
The site at primvote.com is a typosquat clone of the legitimate Privnote service (privnote.com). It presents itself as Privnote, featuring a similar interface for sending self-destructing notes. The domain is only two characters different from the real domain, and it likely collects user credentials through dynamically rendered forms.
Attack Techniques (5)
Typosquat domain (primvote.com → privnote.com)Cloned SPA with identical UIBrand logo loaded from fake domainJavaScript bundle for credential captureIframe used for content delivery from a different domain
Indicators of Compromise (5)
▸Domain: primvote.com
▸Network request to https://privotes.com/static-58c8928/style/legacy/privnote-logo.svg
▸POST request to https://primvote.com/privnote/tg-notion.php
▸Iframe source: https://privotes.com/urNIYtLL
▸Page title: 'Privnote - Send notes that self-destruct after being read'
Risk AssessmentUsed in abuse reports
The domain primvote.com is a newly registered typosquat of the legitimate Privnote service, created just 2 days ago. The page title and URL path explicitly reference Privnote, indicating clear intent to impersonate the brand. Additionally, the site loads resources from privotes.com, further confirming its phishing nature. The SSL certificate was issued only 2 days ago, heightening the risk associated with this domain.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API