privatenots[.]com

Analysis of the domain privatenots.com, registered on February 21, 2026 through NiceNIC International Group Co., Limited, indicates that it was used to host a self‑destructing messaging service as suggested by its page title, “Private Notes - Send Self‑Destructing Secret Messages Securely.” The site resolved to the Cloudflare‑managed address 172.67.151.126, located in the United States and announced as part of AS13335 Cloudflare, Inc. The infrastructure employed Cloudflare’s CDN, HTTP/3 protocol, and front‑end libraries Bootstrap and jsDelivr. No TLS certificate was observed, consistent with the reported lack of SSL. The domain was flagged by three security vendors on VirusTotal, and it appears on three independent blocklists, leading to its removal from active service.

Gridinsoft assigned a trust score of 0 / 100, underscoring a high risk assessment. Defenders should note that the domain’s nameservers are rayne.ns.cloudflare.com and skip.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS. Although the site is currently offline, the combination of a low trust score, multiple vendor detections, and blocklist listings suggests a purposeful phishing operation targeting users seeking private, disposable note‑taking services.

Monitoring for re‑registration or similar domains using the same naming pattern is advised, as is updating web filters to block the associated IP range and Cloudflare‑provided hostnames. Further investigation should focus on any residual payloads or redirects captured before takedown, and on correlating traffic logs for potential credential harvesting attempts tied to this domain.