# PhishDestroy domain threat record: private-notes.to

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/private-notes.to/
Machine-readable companion: https://phishdestroy.io/domain/private-notes.to/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 01:37:56 UTC
- Last availability or vendor check: 2026-10-27 23:48:24 UTC
- Stored record updated: 2026-10-27 23:48:24 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: signal

## Stored infrastructure

- Observed IP address: 84.200.87.55
- Registrar in stored WHOIS data: Tonic
- Registrar country in stored WHOIS data: TO
- Last stored HTTP status: 200
- Registration date (registry RDAP, private-notes.to): 2026-07-15 10:05:18 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16683-67af-757e-8f40-c2a3843b8c7a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/private-notes.to
- Certificate Transparency search: https://crt.sh/?q=%25.private-notes.to
- Web Archive lookup: https://web.archive.org/web/*/https://private-notes.to/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot dated 2026-10-23 shows a dark landing page branded Privnote, headlined Privnote — Send Encrypted Notes That Vanish After Reading, with a blue Use Privnote Today button, an 8.8 user rating panel, and an advantages and limitations list. PhishDestroy classified the page as a seed-phrase theft page after it was first seen on 2026-10-23.

How the scam works
The page presented a free tool to write a private note, share it through a secure link, and watch it self-destruct after one read with no accounts and no traces. In this seed-phrase theft scheme, that lure coaxes visitors into pasting wallet recovery words into an apparently private note whose contents are exposed to the page operator. The rating badge and pros list add false legitimacy.

Evidence
The captured screenshot shows the Privnote lock logo, the vanishing-note headline, the Use Privnote Today button, an 8.8 rating badge, and a pros and cons panel. On 2026-10-23 urlscan's machine-learning engine scored the page 99 and marked it malicious, its overall verdict was not malicious, a 307 redirect from plain HTTP to HTTPS was recorded, and OTX logged 6 pulses. VirusTotal did not flag the domain. Google Safe Browsing had not flagged it on 2026-10-26, Spamhaus did not list it on 2026-10-23, while the MetaMask and SEAL blocklists together with PhishDestroy's internal list flagged it on 2026-10-26 and three tracker requests were recorded.

Infrastructure
Notable weaknesses: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP headers all absent; no SPF, DKIM or DMARC recorded; DNSSEC unsigned while a CAA record was present; TLS 1.3 with AES-256-GCM, forward secrecy and ALPN http/1.1. The domain was registered on 2026-07-15 through registrar Tonic using Cloudflare nameservers, while the recorded network was Ultahost, Inc. with nginx 1.24.0 on Ubuntu.

What to do
If you pasted a recovery phrase or other secret into this captured page, treat it as compromised and move assets to a freshly created wallet whose phrase was never entered on any website, and never reuse the exposed phrase. If you reused a password elsewhere, change it on the genuine service and enable two-factor authentication. Security teams should block private-notes.to and hunt for the same Privnote-style lure in incoming messages.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16683-67af-757e-8f40-c2a3843b8c7a/
Cloudflare Radar report: https://radar.cloudflare.com/scan/e39e6ee2-cc18-4e5f-85a2-2db425833363
URLQuery report: https://urlquery.net/report/de151141-3448-43da-a1a8-500994643e7f
Stored capture screenshot: https://i.ibb.co/1GK7FDYG/c942432e47ca.png
Cloudflare Radar screenshot (2026-10-23T02:03:51Z): https://screenshots.phishdestroy.io/cf/e39e6ee2-cc18-4e5f-85a2-2db425833363.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/de151141-3448-43da-a1a8-500994643e7f.png
URLScan screenshot (2026-09-30T19:20:11Z): https://screenshots.phishdestroy.io/us/01a0f3c2-7221-74b8-9d7d-e52301e5637c.png
URLScan capture report: https://urlscan.io/result/01a0f3c2-7221-74b8-9d7d-e52301e5637c/
URLScan screenshot (2026-10-05T04:05:44Z): https://screenshots.phishdestroy.io/us/01a10a3d-16cd-74ef-b9e0-2f896aca5d24.png
URLScan capture report: https://urlscan.io/result/01a10a3d-16cd-74ef-b9e0-2f896aca5d24/
URLScan screenshot (2026-10-13T05:33:02Z): https://screenshots.phishdestroy.io/us/01a133bf-e10d-7088-820a-5e11b0be36d1.png
URLScan capture report: https://urlscan.io/result/01a133bf-e10d-7088-820a-5e11b0be36d1/
URLScan screenshot (2026-10-13T13:03:11Z): https://screenshots.phishdestroy.io/us/01a1355b-cdaa-7549-b22d-fd226438c942.png
URLScan capture report: https://urlscan.io/result/01a1355b-cdaa-7549-b22d-fd226438c942/
URLScan screenshot (2026-10-17T07:37:04Z): https://screenshots.phishdestroy.io/us/01a148ca-e1c4-71fa-a194-1e7dba50a174.png
URLScan capture report: https://urlscan.io/result/01a148ca-e1c4-71fa-a194-1e7dba50a174/
URLScan screenshot (2026-10-23T02:13:29Z): https://screenshots.phishdestroy.io/us/01a16688-c824-751c-8fe8-b01f3c562691.png
URLScan capture report: https://urlscan.io/result/01a16688-c824-751c-8fe8-b01f3c562691/
VirusTotal report: https://www.virustotal.com/gui/domain/private-notes.to
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=private-notes.to
Archived copy: https://web.archive.org/web/20261023014435/https://private-notes.to/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 22:37:54 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/1GK7FDYG/c942432e47ca.png
  Captured: 2026-10-23 02:09:30 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a16683-67af-757e-8f40-c2a3843b8c7a.png
  Captured: 2026-10-23 02:09:30 UTC
  Source report: https://urlscan.io/result/01a16683-67af-757e-8f40-c2a3843b8c7a/
- URLScan capture 2: https://urlscan.io/screenshots/01a15d01-1857-75ea-aa5b-ff5711453227.png
  Captured: 2026-10-23 01:37:56 UTC
  Source report: https://urlscan.io/result/01a16683-67af-757e-8f40-c2a3843b8c7a/
- URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f3c2-7221-74b8-9d7d-e52301e5637c.png
  Captured: 2026-09-30 19:20:11 UTC
  Source report: https://urlscan.io/result/01a0f3c2-7221-74b8-9d7d-e52301e5637c/
  SHA-256: 8eb33c7e26ed912d9bbec81e25ccf9b0ed22d61a67d48db1d7ec6a6f1df8ad52
- URLScan · 2026-10-05: https://screenshots.phishdestroy.io/us/01a10a3d-16cd-74ef-b9e0-2f896aca5d24.png
  Captured: 2026-10-05 04:05:44 UTC
  Source report: https://urlscan.io/result/01a10a3d-16cd-74ef-b9e0-2f896aca5d24/
  SHA-256: 8eb33c7e26ed912d9bbec81e25ccf9b0ed22d61a67d48db1d7ec6a6f1df8ad52
- URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a133bf-e10d-7088-820a-5e11b0be36d1.png
  Captured: 2026-10-13 05:33:02 UTC
  Source report: https://urlscan.io/result/01a133bf-e10d-7088-820a-5e11b0be36d1/
  SHA-256: 8eb33c7e26ed912d9bbec81e25ccf9b0ed22d61a67d48db1d7ec6a6f1df8ad52
- URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a1355b-cdaa-7549-b22d-fd226438c942.png
  Captured: 2026-10-13 13:03:11 UTC
  Source report: https://urlscan.io/result/01a1355b-cdaa-7549-b22d-fd226438c942/
  SHA-256: 8eb33c7e26ed912d9bbec81e25ccf9b0ed22d61a67d48db1d7ec6a6f1df8ad52
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a148ca-e1c4-71fa-a194-1e7dba50a174.png
  Captured: 2026-10-17 07:37:04 UTC
  Source report: https://urlscan.io/result/01a148ca-e1c4-71fa-a194-1e7dba50a174/
  SHA-256: 8eb33c7e26ed912d9bbec81e25ccf9b0ed22d61a67d48db1d7ec6a6f1df8ad52
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16688-c824-751c-8fe8-b01f3c562691.png
  Captured: 2026-10-23 02:13:29 UTC
  Source report: https://urlscan.io/result/01a16688-c824-751c-8fe8-b01f3c562691/
  SHA-256: 8eb33c7e26ed912d9bbec81e25ccf9b0ed22d61a67d48db1d7ec6a6f1df8ad52
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e39e6ee2-cc18-4e5f-85a2-2db425833363.png
  Captured: 2026-10-23 02:03:51 UTC
  Source report: https://radar.cloudflare.com/scan/e39e6ee2-cc18-4e5f-85a2-2db425833363
  SHA-256: 924cbde2f81a2edb04b6f73719bd2c4f783d6c8836fc05302b2160e2ca3e332f
- URLQuery: https://screenshots.phishdestroy.io/uq/de151141-3448-43da-a1a8-500994643e7f.png
  Source report: https://urlquery.net/report/de151141-3448-43da-a1a8-500994643e7f
  SHA-256: dd05ffea82dbcb5a7acf0b661e70f822ddc27447398ad98537b4099a5ab203b7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T02:14:51Z",
        "uuid": "01a16683-67af-757e-8f40-c2a3843b8c7a",
        "scanned_at": "2026-10-23T02:07:35Z",
        "final_url": "https://private-notes.to/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://private-notes.to/",
                "from": "http://private-notes.to/",
                "status": 307
            }
        ],
        "ip": "84.200.87.55",
        "ips": [
            "84.200.87.55"
        ],
        "asns": [
            "214036"
        ],
        "countries": [
            "DE"
        ],
        "link_domains": [
            "privnote.com",
            "www.saashub.com"
        ],
        "doc_hash": "ddf332de1cd88e5cfdf134c85a4c3303465334df555f7081d4327bbc2a19fea5",
        "cookies": [
            "PHPSESSID",
            "e3b0c4_73",
            "_token",
            "_subid"
        ],
        "tls": {
            "san": [
                "private-notes.to"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YE1",
            "subject": "private-notes.to",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-10T12:22:22Z",
            "valid_from": "2026-10-12T12:22:23Z"
        },
        "domain_age_days": 94,
        "apex_age_days": 94,
        "tls_age_days": 10,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.24.0 (Ubuntu)",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T02:14:51Z",
        "uuid": "e39e6ee2-cc18-4e5f-85a2-2db425833363",
        "scanned_at": "2026-10-23T02:03:51Z",
        "final_url": "https://private-notes.to/",
        "status": 200,
        "history": [
            {
                "url": "https://private-notes.to/",
                "status": 200
            }
        ],
        "dom_hash": "bed7de86df62d54842ddc45b85068011331dbbabeb9d7ace801b50a7e1c151f8",
        "doc_hash": "ddf332de1cd88e5cfdf134c85a4c3303465334df555f7081d4327bbc2a19fea5",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "private-notes.to",
                "type": "A",
                "value": "84.200.87.55"
            }
        ],
        "dnssec_valid": false,
        "ip": "84.200.87.55",
        "whois": {
            "registrar": "Tonic",
            "created": "2026-07-15T10:05:18Z",
            "updated": "2026-07-20T13:55:44Z",
            "expires": "2028-07-15T10:05:18Z",
            "nameservers": [
                "becky.ns.cloudflare.com",
                "earl.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T02:02:09Z",
        "analysis_at": "2026-10-22T12:13:47Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 38
        },
        "reputation": 0,
        "registrar": "Tonic",
        "created": "2026-07-15T10:05:18Z",
        "expires": "2028-07-15T10:05:18Z",
        "updated": "2026-07-20T13:55:44Z",
        "first_seen": "2026-07-20T15:07:23Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "becky.ns.cloudflare.com"
            },
            {
                "ttl": 120,
                "type": "A",
                "value": "84.200.87.55"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "becky.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "earl.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-22T12:14:06Z",
        "jarm": "28d28d28d00028d00042d42d000000831b6af40378e2dd35eeac4e9311926e",
        "cert": {
            "san": [
                "private-notes.to"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "58521bf7620fa1e169363fd9292d42d8963",
            "sha256": "94a0fe6989eb248b40d2caf1554e78ecf69c2efa9a5f3aed5d72f9f8e236cf9c",
            "subject": "private-notes.to",
            "valid_to": "2027-01-10T12:22:22Z",
            "valid_from": "2026-10-12T12:22:23Z"
        },
        "whois": {
            "registrar": "Tonic",
            "registrar_iana_id": "6763001",
            "registrar_url": "tonic.to",
            "created": "2026-07-15T10:05:18Z",
            "updated": "2026-07-20T13:55:44Z",
            "expires": "2028-07-15T10:05:18Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "becky.ns.cloudflare.com",
                "earl.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2028-07-15T10:05:18Z",
                "last changed": "2026-07-20T13:55:44Z",
                "registration": "2026-07-15T10:05:18Z",
                "last update of RDAP database": "2026-10-21T13:34:26Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T02:15:02Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "private-notes.to"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T01:44:35Z",
            "first": "2026-10-23T01:44:35Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 8723
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://private-notes.to/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 3
        },
        "social_tags": {
            "ogUrl": "https://private-notes.to/",
            "title": "Privnote | Encrypted Self-Destructing Notes",
            "author": "Privnote",
            "ogType": "website",
            "robots": "index, follow",
            "ogImage": "https://private-notes.to/og-image.jpg",
            "ogTitle": "Privnote | Encrypted Self-Destructing Notes",
            "keywords": "privnote, note, private note, new note, private, message, secure, send, secure message, send note",
            "ogSiteName": "Privnote",
            "themeColor": "#00B0FF",
            "description": "Privnote lets you send encrypted self-destructing notes in seconds. Discover how Privnote keeps every private message secure, private, and untraceable.",
            "twitterCard": "summary",
            "canonicalUrl": "https://private-notes.to/",
            "ogDescription": "the platform lets you send encrypted self-destructing notes in seconds. Discover how Privnote keeps every private message secure, private, and untraceable."
        },
        "trackers": {
            "requests": 3
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 3,
                "tls": 28,
                "wait": 103,
                "connect": 42,
                "download": 0
            },
            "response_ms": 176
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 28032,
            "co2_grams": 0.001,
            "cleaner_than": 49
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.161",
                    "host": "earl.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.192.73",
                    "host": "becky.ns.cloudflare.com"
                }
            ],
            "zone": "private-notes.to"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "PHPSESSID",
                    "session": true
                },
                {
                    "name": "e3b0c4_73",
                    "http_only": true
                },
                {
                    "name": "_token",
                    "http_only": true
                },
                {
                    "name": "_subid",
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "84.200.87.55",
            "asn": "214036",
            "org": "Ultahost, Inc.",
            "city": "Frankfurt am Main",
            "country": "DE"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "private-notes.to"
        },
        "dns": {
            "A": [
                "84.200.87.55"
            ],
            "NS": [
                "earl.ns.cloudflare.com",
                "becky.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"becky.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417296455, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "84.200.87.55",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://private-notes.to"
            ]
        },
        "tech_stack": {
            "technologies": [
                "PHP",
                "Google Maps",
                "Ubuntu",
                "YouTube",
                "Nginx",
                "Google Font API",
                "PWA",
                "Open Graph"
            ]
        },
        "linked_pages": {
            "external": [
                "https://privnote.com/",
                "https://www.saashub.com/privnote"
            ],
            "external_count": 2,
            "internal_count": 3
        },
        "whois": {
            "registrar": "Tonic",
            "created": "2026-07-15T10:05:18Z",
            "updated": "2026-07-20T13:55:44Z",
            "expires": "2028-07-15T10:05:18Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "becky.ns.cloudflare.com",
                "earl.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx/1.24.0 (Ubuntu)",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```