prlvnotre[.]com

This domain, prlvnotre.com, is flagged as a high-risk brand impersonation threat targeting Facebook. The domain was registered on March 11, 2026, through CSL Computer Service Langenbach GmbH d/b/a joker.com, and resolves to IP 188.114.96.3, hosted by Cloudflare, Inc. (AS13335) in the United States. The page title is 'Privnote - Sende Nachrichten, die sich selbst zerstören, nachdem sie gelesen wurden', indicating a self-destructing message service theme, which is used to mask the phishing intent. VirusTotal reports 2 of 94 security vendors flagging this domain, and it appears on three security blocklists. The domain is blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX includes it in one threat intelligence pulse. The SSL certificate is issued by Google Trust Services. Infrastructure analysis reveals nameservers beau.ns.cloudflare.com and tiffany.ns.cloudflare.com, consistent with Cloudflare hosting. The Gridinsoft trust score is 0/100, reflecting strong suspicion. The exact impersonation method is not detailed, but the brand target confirms Facebook as the impersonated entity. Defenders should block the domain at the network level, monitor for related subdomains or IPs (188.114.96.3), and report to hosting provider and registrar. Users may encounter messages or emails directing them to this site; awareness campaigns should warn against interacting with the domain. Uncertainty remains regarding the full phishing kit and delivery vector, as page content beyond the title is not yet analyzed.