privnote[.]site

The domain privnote.site is identified as a credential-harvesting phishing site impersonating the legitimate Privnote service, which provides secure self-destructing notes. This domain is currently offline but was actively used to deceive users into submitting sensitive information under the guise of anonymous private messaging. Analysis indicates the threat specifically targets users seeking encrypted communication, redirecting them to fraudulent login or data submission portals. Infrastructure analysis reveals the domain was created on April 7, 2026, and registered through NameSilo, LLC. It resolves to the IP address 176.57.67.101 and is flagged by 16 of 95 security vendors on VirusTotal. The domain appears on three security blocklists and is actively blocked by multiple threat detection systems, including MetaMask and PhishDestroy. Detected technologies include Tilda, Hammer.js, and DDoS-Guard, which are often leveraged to obfuscate malicious activity. Trust scores from Scamadviser and Gridinsoft are notably low, at 31/100 and 0/100, respectively, further corroborating its malicious intent. Current status indicates the domain has been taken offline, though similar infrastructure may reemerge under different names. Users are advised to verify the authenticity of any Privnote-related domain by checking for the official SSL certificate, cross-referencing with known legitimate URLs, and consulting updated threat intelligence feeds. Organizations should update blocklists to include this domain and monitor for related indicators of compromise, such as the associated IP address and registrar details. Exercise caution when accessing secure messaging services, and report any suspicious domains to relevant security teams for further investigation.