mass.report
Scan Intelligence Report0/100
critical Risk
privacnote.com
https://privacnote.com/notes/
IP
104.21.3.170 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
3 days ⚠
HTTP
200 · 12.7s
SSL
Valid· E7, Let's Encrypt, US
Status
COMPLETED
Domain Intelligence: privacnote.com
Scanned 2 times since Apr 12, 2026, 11:44 AM UTC
✗ Critical (100)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
31/31
Status
completed
✓ bitdefender✓ avast✓ avg✓ brightcloud✓ chainpatrol✓ sophos✓ yandex✓ eset✓ microsoft✓ norton✓ polyswarm✓ apple✓ isitphish✓ urlquery✓ cisa✓ apwg✓ phishtank✓ phishreport✓ netcraft✓ emsisoft✓ urlscan✓ spamhaus✓ openphish✓ drweb✓ virustotal✓ urlabuse✓ mcafee✓ threatyeti✓ google✓ kaspersky✓ fortiguard
KB/IOK Matches (1)Apr 12, 2026, 11:44 AM UTC
Privnote Clone Kit
privnote-clone-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
Privnote
Payment FraudCryptocurrency · 4/15/2026
Summary
This page is a clone of Privnote built from a known phishing kit. It reproduces the exact Privnote UI structure and branding on a non-official domain. These clones are used for cryptocurrency theft — they intercept or replace wallet addresses in notes that victims share, sometimes exfiltrating data via Telegram webhooks. The domain is not affiliated with the legitimate privnote.com.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸Canonical stage contains password collection UI.
▸POST targets observed during capture: https://privacnote.com/cdn-cgi/rum?.
▸Distinctive asset clues: email-decode.min.js, v8c78df7c7c0f484497ecbca7046644da1771523124516, app.css, privnote-logo.svg, privnote-page-flip-30.png.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 1
Password fields: 3
Late-stage login UI: No
Resource Signals
Resources: 12
Hosts: 2
Domains: 2
Suspicious Endpoints
hxxps://privacnote[.]com/notes/
hxxps://privacnote[.]com/notes/api/send.php
Attack Techniques (3)
Privnote brand impersonation (title, logo, full UI clone)Known clone kit DOM structure (new_note, encrypt_note, note_raw element IDs)Cryptocurrency address interception or backend swapping
Indicators of Compromise (3)
▸Page title matches Privnote branding
▸Clone kit HTML structure with exact Privnote element IDs
▸Privnote logo served from non-official domain
Risk AssessmentUsed in abuse reports
This domain serves a known Privnote clone kit identified by its HTML structure and branding assets. These kits are deployed across many typosquat domains and are used for cryptocurrency theft — typically by intercepting or replacing wallet addresses in shared notes. The kit is not affiliated with the legitimate privnote.com service. This is a confirmed malicious deployment that warrants immediate domain suspension and hosting takedown.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API