priwnotes[.]com

Analysis of priwnotes.com indicates that the domain was registered on 21 February 2026 and currently resolves to the IPv4 address 66.29.148.38, which is hosted by Namecheap, Inc. under ASN 22612 in the United States. The site presents a page title identical to the legitimate service Privnote, describing a “Send notes that will self‑destruct after being read” feature. The TLS certificate in use is issued by Sectigo Public Server Authentication CA DV R36, confirming that HTTPS is available but providing no assurance of legitimacy. On 24 July 2026 the domain was flagged by five of ninety‑three VirusTotal scanners, indicating that a minority of security vendors have identified malicious activity.

Independent blocklist monitoring shows that the domain is listed on a single security blocklist and is actively blocked by the PhishDestroy filtering service. Nameserver records point to launch1.spaceship.net and launch2.spaceship.net, which are commonly observed in transient hosting environments. The domain’s current operational status is offline, suggesting that the malicious infrastructure may have been taken down or is temporarily inaccessible. The available evidence confirms that priwnotes.com is being used for a generic phishing campaign that leverages the trusted Privnote branding to lure victims into submitting confidential information.

However, the limited number of detection vendor hits and the presence on only one public blocklist leave uncertainty about the scale of the campaign and whether additional payloads or credential‑harvesting pages exist. Defenders should continue to monitor the IP address 66.29.148.38 for any re‑appearance of malicious services, enforce blocks on the domain across corporate web filters, and consider adding the domain to internal deny lists.