privsote.com

Findings

Each finding below is derived from a captured artifact. Expand one to see exactly what it was drawn from.

Analyst summary

Observed 2 capture stage(s); canonical stage is settled_render.
Canonical stage contains password collection UI.
POST targets observed during capture: https://privsote.com/cdn-cgi/rum?.
Distinctive asset clues: email-decode.min.js, v833ccba57c9e4d2798f2e76cebdd09a11778172276447, app.css, privnote-logo.svg, privnote-page-flip-30.png.

Supported findings2

Brand impersonation of Privnote
Brand Impersonation
privsote.com is not the official Privnote domain, while the captured page presents Privnote branding.
deterministic correlation
Credential collection on an impersonating page
Credential Phishing
The impersonating page contains password-entry UI and an observed submission or collection endpoint.
deterministic correlation

Capture signals

Forms: 1
Password fields: 3
Resources: 12
Distinct hosts: 2

Suspicious endpoints

https://privsote.com/notes/
https://privsote.com/notes/api/send.php

Threat-KB / IOK matches1

Matched May 17, 2026, 03:22 PM UTC

Privnote Clone Kit
privnote-clone-kit
high
Family privnote