mass.report
Scan Intelligence Report0/100
critical Risk
plivnote.com
https://plivnote.com/notes
IP
172.67.158.75 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
0 days ⚠
HTTP
200 · 14.2s
SSL
Valid· E7, Let's Encrypt, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
28/31
Status
partial
✗ avg✓ brightcloud✓ drweb✓ chainpatrol✓ polyswarm✓ sophos✓ yandex✓ eset✗ avast✓ microsoft✓ bitdefender✗ norton✓ apple✓ apwg✓ cisa✓ emsisoft✓ openphish✓ spamhaus✓ virustotal✓ netcraft✓ urlscan✓ phishtank✓ phishreport✓ urlquery✓ isitphish✓ urlabuse✓ mcafee✓ google✓ threatyeti✓ kaspersky✓ fortiguard
KB/IOK Matches (1)Apr 23, 2026, 04:15 PM UTC
Privnote Clone Kit
privnote-clone-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
Privnote
Payment FraudCryptocurrency · 4/29/2026
Summary
This page is a clone of Privnote built from a known phishing kit. It reproduces the exact Privnote UI structure and branding on a non-official domain. These clones are used for cryptocurrency theft — they intercept or replace wallet addresses in notes that victims share, sometimes exfiltrating data via Telegram webhooks. The domain is not affiliated with the legitimate privnote.com.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸Canonical stage contains password collection UI.
▸POST targets observed during capture: https://plivnote.com/cdn-cgi/rum?.
▸Distinctive asset clues: email-decode.min.js, v8c78df7c7c0f484497ecbca7046644da1771523124516, app.css, logo.svg, privnote-page-flip-30.png.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 1
Password fields: 3
Late-stage login UI: No
Resource Signals
Resources: 13
Hosts: 2
Domains: 2
Suspicious Endpoints
hxxps://plivnote[.]com/notes/
hxxps://plivnote[.]com/notes/api/send.php
Attack Techniques (3)
Privnote brand impersonation (title, logo, full UI clone)Known clone kit DOM structure (new_note, encrypt_note, note_raw element IDs)Cryptocurrency address interception or backend swapping
Indicators of Compromise (3)
▸Page title matches Privnote branding
▸Clone kit HTML structure with exact Privnote element IDs
▸Privnote logo served from non-official domain
Risk AssessmentUsed in abuse reports
This domain serves a known Privnote clone kit identified by its HTML structure and branding assets. These kits are deployed across many typosquat domains and are used for cryptocurrency theft — typically by intercepting or replacing wallet addresses in shared notes. The kit is not affiliated with the legitimate privnote.com service. This is a confirmed malicious deployment that warrants immediate domain suspension and hosting takedown.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API