Fake Lawsuit Threat Exposes Privnote Phishing Sites

A network of phishing sites impersonating the self-destructing messaging service Privnote (e.g., tornote.io, privnote.co, privatemessage.net and many similar domains) is actively replacing cryptocurrency addresses in user-created notes with attacker-controlled addresses to steal funds. The report documents domain registration patterns (including ties to registrant strings like “BPW” and “Tambov district”), shared hosting and IP infrastructure (including DDoS-Guard and IP 186.2.163.216), related phishing domains (including MetaMask phishing lookalikes), and measured financial activity (one set of malicious addresses collected nearly $18,000 between March 15–19, 2024).