privnmote[.]com

This domain, privnmote.com, is identified as a Privnote brand impersonation site designed to deceive users into disclosing sensitive information or credentials. The infrastructure is currently offline, but prior activity indicates an intent to mimic legitimate self-destructing note services. Analysis confirms the domain was actively used for credential theft or unauthorized data collection under the guise of a trusted platform. Infrastructure analysis reveals privnmote.com was registered on February 21, 2026, through NiceNIC International Group Co., Limited. The domain resolved to the IP address 104.21.19.58 and was flagged by 7 of 95 security vendors on VirusTotal. It appeared on three security blocklists and received a trust score of 0/100 from Gridinsoft. The page title, "Privnote - Send notes that will self-destruct after being read," directly impersonates the legitimate Privnote service, increasing the likelihood of user deception. Additional blocking was observed by MetaMask, SEAL, and PhishDestroy, further validating its malicious classification. The domain is currently offline, but its prior operational status and technical indicators suggest a high risk of re-emergence or reuse in similar campaigns. Organizations and individuals are advised to block the domain at the network level, monitor for related infrastructure, and educate users on recognizing brand impersonation tactics. Security teams should review logs for prior interactions with 104.21.19.58 or the domain to assess potential exposure. Proactive measures, including DNS filtering and endpoint protection updates, are recommended to mitigate residual risk from this threat.