plivnote.com

Findings

Each finding below is derived from a captured artifact. Expand one to see exactly what it was drawn from.

Analyst summary

Observed 2 capture stage(s); canonical stage is settled_render.
Canonical stage contains password collection UI.
POST targets observed during capture: https://plivnote.com/cdn-cgi/rum?.
Distinctive asset clues: email-decode.min.js, v8c78df7c7c0f484497ecbca7046644da1771523124516, app.css, logo.svg, privnote-page-flip-30.png.

Supported findings0

No finding met the evidence bar for this capture. That is a statement about the evidence, not a clearance.

Capture signals

Forms: 1
Password fields: 3
Resources: 13
Distinct hosts: 2

Suspicious endpoints

https://plivnote.com/notes/
https://plivnote.com/notes/api/send.php

Threat-KB / IOK matches1

Matched Apr 23, 2026, 04:15 PM UTC

Privnote Clone Kit
privnote-clone-kit
high
Family privnote