域安全和威胁情报

private-notes.to

Name: private-notes.to — PhishDestroy evidence record
Published: 2026-10-23
License: https://creativecommons.org/licenses/by/4.0/

简要

private-notes.to：助记词钓鱼，PhishDestroy 于 2026-10-23 检测到。风险：关键（80/100）。注册商：Tonic。状态：最后一次已知在线状态。托管：Ultahost, Inc。PhishDestroy 已发送1 份滥用举报。VirusTotal：6/92 个引擎标记。请勿输入登录凭据，也不要连接钱包。

“Privnote | Encrypted Self-Destructing Notes”

查看证据

注册商: Tonic
IP 地址: 84.200.87.55Ultahost, Inc.
注册时间: 2026年7月15日
首次观测: 2026年10月23日

PhishDestroy评估关键

80/100

证据评分

可用性 最后一次已知在线状态 最新存储的可达性观察观测时间 2026年10月27日 · 23:48 UTCHTTP 探测

风险信号

病毒检测总数：6/92 存储的阻止列表匹配项：2 自动品牌标签：Signal 诈骗类型：助记词被盗

VirusTotal

6 / 92

发动机检测 · 2026-10-27

黑名单匹配项

MetaMask, SEAL

OTX

社区参考资料

URLScan

恶意

引擎判定 · 评分 99

页面快照

打开图库

域名年龄

104 天

已发送举报

查看时间线

ABUSE NOTICE · 72H+ OPEN 外发滥用报告均被记录；存储的最新可用性证据仍显示该域名可访问。

通知与当前状态证据

已发送报告日志记录了首份外发报告的时间为 2026-10-23 02:29:33 UTC. The recorded recipient is u-abuse@ultahost.com. 最新的存储可用性证据仍显示该域名可访问; 4 days 自首份外发报告发布以来，已过去……

ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.

自首次报告以来的时间

4 days

已发送举报

分析

域名概览

关键

状态: 最后一次已知在线状态
VirusTotal: 6 / 92
黑名单匹配项: 2
诈骗类型: 助记词被盗
托管: 84.200.87.55Ultahost, Inc.
注册商: Tonic
注册时间: 2026年7月15日
OTX: 6 community refs
页面快照: 11

页面快照来源结果注册记录

PhishDestroy威胁报告2026-10-26 22:37:54 UTC

Overview

The captured screenshot dated 2026-10-23 shows a dark landing page branded Privnote, headlined Privnote — Send Encrypted Notes That Vanish After Reading, with a blue Use Privnote Today button, an 8.8 user rating panel, and an advantages and limitations list. PhishDestroy classified the page as a seed-phrase theft page after it was first seen on 2026-10-23.

How the scam works

The page presented a free tool to write a private note, share it through a secure link, and watch it self-destruct after one read with no accounts and no traces. In this seed-phrase theft scheme, that lure coaxes visitors into pasting wallet recovery words into an apparently private note whose contents are exposed to the page operator. The rating badge and pros list add false legitimacy.

证据

The captured screenshot shows the Privnote lock logo, the vanishing-note headline, the Use Privnote Today button, an 8.8 rating badge, and a pros and cons panel. On 2026-10-23 urlscan's machine-learning engine scored the page 99 and marked it malicious, its overall verdict was not malicious, a 307 redirect from plain HTTP to HTTPS was recorded, and OTX logged 6 pulses. VirusTotal did not flag the domain. Google Safe Browsing had not flagged it on 2026-10-26, Spamhaus did not list it on 2026-10-23, while the MetaMask and SEAL blocklists together with PhishDestroy's internal list flagged it on 2026-10-26 and three tracker requests were recorded.

基础设施

Notable weaknesses: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP headers all absent; no SPF, DKIM or DMARC recorded; DNSSEC unsigned while a CAA record was present; TLS 1.3 with AES-256-GCM, forward secrecy and ALPN http/1.1. The domain was registered on 2026-07-15 through registrar Tonic using Cloudflare nameservers, while the recorded network was Ultahost, Inc. with nginx 1.24.0 on Ubuntu.

What to do

If you pasted a recovery phrase or other secret into this captured page, treat it as compromised and move assets to a freshly created wallet whose phrase was never entered on any website, and never reuse the exposed phrase. If you reused a password elsewhere, change it on the genuine service and enable two-factor authentication. Security teams should block private-notes.to and hunt for the same Privnote-style lure in incoming messages.

来源证据VirusTotal 6 / 92 · OTX 6 references 9 个来源

VirusTotal

6 / 92 发动机检测 · 存储的摘要

2026-10-27 03:02 UTC

打开报告

VirusTotal来源原始记录观测时间: 2026-10-22 12:13:47 UTC13 个字段

观测时间: 2026-10-22T12:13:47Z · 检索到: 2026-10-23T02:02:09Z

供应商结果计数

超时: 0
无害: 54
恶意: 0
可疑的: 0
未检测到: 38

信誉评分

注册商

Tonic

创建

2026-07-15 10:05:18 UTC

有效期至

2028-07-15 10:05:18 UTC

已更新

2026-07-20 13:55:44 UTC

首次发现

2026-07-20 15:07:23 UTC

DNS 记录

TTL（秒）
1800
类型
SOA
负责人邮箱
dns.cloudflare.com
值
becky.ns.cloudflare.com
TTL（秒）
120
类型
A
值
84.200.87.55
TTL（秒）
21600
类型
NS
值
becky.ns.cloudflare.com
TTL（秒）
21600
类型
NS
值
earl.ns.cloudflare.com

DNS 记录获取时间

2026-10-22 12:14:06 UTC

JARM 指纹

28d28d28d00028d00042d42d000000831b6af40378e2dd35eeac4e9311926e

证书

使用者备用名称（SAN）: private-notes.to
签发者: Let's Encrypt / YE1
序列号: 58521bf7620fa1e169363fd9292d42d8963
SHA-256: 94a0fe6989eb248b40d2caf1554e78ecf69c2efa9a5f3aed5d72f9f8e236cf9c
使用者（Subject）: private-notes.to
到期时间: 2027-01-10 12:22:22 UTC
生效时间: 2026-10-12 12:22:23 UTC

注册记录

注册商: Tonic
注册商 IANA ID: 6763001
注册商 URL: tonic.to
注册时间: 2026-07-15 10:05:18 UTC
已更新: 2026-07-20 13:55:44 UTC
有效期至: 2028-07-15 10:05:18 UTC
状态: clientTransferProhibited
域名服务器: becky.ns.cloudflare.com
earl.ns.cloudflare.com
DNSSEC: unsigned

注册局数据（RDAP）

状态

client transfer prohibited

注册局事件

注册到期: 2028-07-15 10:05:18 UTC
最后更改: 2026-07-20 13:55:44 UTC
注册信息: 2026-07-15 10:05:18 UTC
RDAP 数据库最近更新: 2026-10-21 13:34:26 UTC

来源原始字段 · JSON

供应商结果计数	{ "timeout": 0, "harmless": 54, "malicious": 0, "suspicious": 0, "undetected": 38 }
声誉	0
注册商	Tonic
创建	2026-07-15T10:05:18Z
有效期至	2028-07-15T10:05:18Z
已更新	2026-07-20T13:55:44Z
首次发现	2026-07-20T15:07:23Z
DNS 记录	[ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "becky.ns.cloudflare.com" }, { "ttl": 120, "type": "A", "value": "84.200.87.55" }, { "ttl": 21600, "type": "NS", "value": "becky.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "earl.ns.cloudflare.com" } ]
Dns at	2026-10-22T12:14:06Z
Jarm	28d28d28d00028d00042d42d000000831b6af40378e2dd35eeac4e9311926e
证书	{ "san": [ "private-notes.to" ], "issuer": "Let's Encrypt / YE1", "serial": "58521bf7620fa1e169363fd9292d42d8963", "sha256": "94a0fe6989eb248b40d2caf1554e78ecf69c2efa9a5f3aed5d72f9f8e236cf9c", "subject": "private-notes.to", "valid_to": "2027-01-10T12:22:22Z", "valid_from": "2026-10-12T12:22:23Z" }
注册记录	{ "registrar": "Tonic", "registrar_iana_id": "6763001", "registrar_url": "tonic.to", "created": "2026-07-15T10:05:18Z", "updated": "2026-07-20T13:55:44Z", "expires": "2028-07-15T10:05:18Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "becky.ns.cloudflare.com", "earl.ns.cloudflare.com" ], "dnssec": "unsigned" }
注册表数据	{ "status": [ "client transfer prohibited" ], "events": { "expiration": "2028-07-15T10:05:18Z", "last changed": "2026-07-20T13:55:44Z", "registration": "2026-07-15T10:05:18Z", "last update of RDAP database": "2026-10-21T13:34:26Z" } }

单独的源记录 · 0 malicious + 0 suspicious / 92 · 2026-10-22 12:13:47 UTC

上述摘要和此服务提供商记录是在不同时间收集的。两者均仍可查阅；恶意和可疑的分类结果分别显示。

record_source: collected_observations.vt
analysis_at: 2026-10-22T12:13:47Z
fetched_at: 2026-10-23T02:02:09Z
stats: {"timeout":0,"harmless":54,"malicious":0,"suspicious":0,"undetected":38}

URLScan

恶意 · 引擎判定 · 评分 99

SHA-256 a051b23da62b5895a81a1ff9312194bda1e5b8f5d0495807c02b0d2bf5d74ec4

2026-10-23 02:07 UTC

打开报告

URLScan来源原始记录观测时间: 2026-10-23 02:07:35 UTC20 个字段

观测时间: 2026-10-23T02:07:35Z · 检索到: 2026-10-23T02:14:51Z

报告 ID

01a16683-67af-757e-8f40-c2a3843b8c7a

最终 URL

https://private-notes.to/

HTTP 响应

200

重定向类型

https-only

重定向

目标
https://private-notes.to/
来源
http://private-notes.to/
状态
307

IP 地址

84.200.87.55

已联系的 IP 地址

84.200.87.55

自治系统（ASN）

214036

服务器所在国家/地区

关联域名

privnote.com
www.saashub.com

文档哈希值

ddf332de1cd88e5cfdf134c85a4c3303465334df555f7081d4327bbc2a19fea5

Cookie

PHPSESSID
e3b0c4_73
_token
_subid

TLS 会话与证书

使用者备用名称（SAN）: private-notes.to
加密套件: AES_256_GCM
签发者: YE1
使用者（Subject）: private-notes.to
协议: TLS 1.3
到期时间: 2027-01-10 12:22:22 UTC
生效时间: 2026-10-12 12:22:23 UTC

域名年龄（天）

注册域名年龄（天）

证书年龄（天）

证书有效期（天）

页面请求数

服务提供商评定结果

引擎判定

标签: urlscan-ml
urlscan-ml-60c5e22
评分: 99
恶意: 是

总体判定

评分: 0
恶意: 否

HTTP 头

服务器: nginx/1.24.0 (Ubuntu)
Content-type: text/html; charset=UTF-8

来源原始字段 · JSON

Uuid	01a16683-67af-757e-8f40-c2a3843b8c7a
Final url	https://private-notes.to/
状态	200
已重定向	https-only
重定向	[ { "to": "https://private-notes.to/", "from": "http://private-notes.to/", "status": 307 } ]
Ip	84.200.87.55
已联系的 IP 地址	[ "84.200.87.55" ]
Asns	[ "214036" ]
Countries	[ "DE" ]
关联域名	[ "privnote.com", "www.saashub.com" ]
文档哈希值	ddf332de1cd88e5cfdf134c85a4c3303465334df555f7081d4327bbc2a19fea5
Cookie	[ "PHPSESSID", "e3b0c4_73", "_token", "_subid" ]
Tls	{ "san": [ "private-notes.to" ], "cipher": "AES_256_GCM", "issuer": "YE1", "subject": "private-notes.to", "protocol": "TLS 1.3", "valid_to": "2027-01-10T12:22:22Z", "valid_from": "2026-10-12T12:22:23Z" }
域名年龄（天）	94
Apex age days	94
Tls age days	10
TLS 有效天数	89
请求	4
服务提供商评定结果	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }
HTTP 头	{ "server": "nginx/1.24.0 (Ubuntu)", "content-type": "text/html; charset=UTF-8" }

单独的监视器记录 · 日期未记录

单独存储的监控快照；不会替换主报告记录，也不会确定当前的可用性。

record_source: domain_monitor.urlscan
uuid: 01a15d01-1857-75ea-aa5b-ff5711453227
report_url: https://urlscan.io/result/01a15d01-1857-75ea-aa5b-ff5711453227/
评分: null
malicious: null
result_at: null
enriched_at: 2026-10-23T08:15:15Z
source_timestamps: {"urlscan_result_at":null,"urlscan_enriched_at":"2026-10-23 10:15:15"}
timestamp_basis: Europe/Berlin，与现有报告中使用的格式一致；源时间戳按原样保留

URLQuery

扫描报告

打开报告

OTX

6 community references

2026-10-23 02:04 UTC

打开报告

Cloudflare Radar

provider verdict: clean

打开报告

Cloudflare Radar来源原始记录观测时间: 2026-10-23 02:03:51 UTC11 个字段

观测时间: 2026-10-23T02:03:51Z · 检索到: 2026-10-23T02:14:51Z

报告 ID

e39e6ee2-cc18-4e5f-85a2-2db425833363

最终 URL

https://private-notes.to/

HTTP 响应

200

跳转记录

URL
https://private-notes.to/
状态
200

DOM 结构哈希

bed7de86df62d54842ddc45b85068011331dbbabeb9d7ace801b50a7e1c151f8

文档哈希值

ddf332de1cd88e5cfdf134c85a4c3303465334df555f7081d4327bbc2a19fea5