What Gridinsoft observed on Biolink.info
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260902160047-b0b2d66e
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- User-Controlled Link-in-Bio Platform — Exact-Page Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent first-party review did not reproduce a current exact phishing or malware object on the BioLink operator surface or within the bounded set of 500 public URLs. Public sandbox and threat-intelligence labels were domain or CrossDomain blacklist classifications without an observed exact payload, credential receiver, malicious file, or hash. BioLink is nevertheless a mutable user-controlled link-in-bio platform, so a normal root and finite sample cannot prove that every user path and outbound destination is safe. The operator-domain Safe status is compatible with this result, while any specific reported page requires a separate exact-URL review.
Analyst findings
Review 7 documented observations View evidence
The apex and www hosts returned the expected BioLink operator site over HTTPS. The reviewed login route used a same-origin form, the privacy route led to the related biolink.website operator site, and the tested operator routes did not initiate an unrelated redirect, automatic download, or delivery of an executable or archive.
-
HTTP status
200 -
Final URL
https://biolink.info/ - Page element Home - BioLink
- Analyst observation The password input observed at /login submitted to the expected same-origin BioLink application; no password form was found on the reviewed public user pages.
- Analyst observation No automatic off-domain redirect, executable or archive reference, command-shell instruction, or malware object was observed on the reviewed operator routes.
A bounded current crawl reviewed 500 distinct URLs assembled from operator examples, public urlscan and OTX records, Triage reports, and recent archive paths. It returned 365 successful pages, 131 missing pages, and four URL-encoding errors; 356 successful responses were public user pages. No reviewed page automatically redirected off-domain, accepted a file upload, referenced an executable or archive, or exposed a command-shell instruction. Four password forms were the expected operator login routes.
- Analyst observation Reviewed URLs: 500; HTTP 200: 365; HTTP 404: 131; URL-encoding errors: 4; active public user pages: 356.
- Analyst observation External automatic redirects: 0; file-upload forms: 0; executable or archive references: 0; command-shell references: 0.
- Analyst observation Password-form pages: 4, all corresponding to same-origin operator login route variants.
- Analyst observation User pages contained mutable links to ordinary external social, messaging, document, commerce, charity, and advertising services; those destinations were not thereby certified.
Exact paths surfaced by public sandbox indexes were checked directly. /fatkw, /CondoMaps, /RobloxCondos, /salg, /grc, and /rrxaa returned 404. /LSvkzETBxk and /littleguardians returned ordinary link pages, and /DhcTlvMfTtdeiVoAS6W9 returned an adult-oriented user link page with an advertising destination. The reviewed active pages did not expose a credential receiver, malware download, executable, or command-shell behavior.
- Analyst observation Six publicly indexed exact paths were inactive with HTTP 404 at review time.
- Analyst observation Three publicly indexed exact paths remained active; their reviewed HTML contained no password form, file upload, executable or archive reference, or command-shell instruction.
- Public artifact URL https://tria.ge/reports
- Analyst observation The adult-oriented link page and its advertising link were recorded as current content, not treated as proof of phishing, malware, or criminal conduct.
Reviewed ANY.RUN reports labeled the root domains and several paths malicious or phishing, but the cited detection was a CrossDomain suspected-phishing domain-reputation rule. The displayed records did not identify a malware configuration, exact credential receiver, harmful downloaded file, payload, or hash for the submitted BioLink URL. This is a domain blacklist classification rather than an observed malicious sample.
- Public artifact URL https://any.run/report/f29ba1253b3be33569cfcc696802a9f4af676e5f400d4caa491cd64819239634/1bc14ba4-fbcb-4809-92e5-294c5bd0072e
- Public artifact URL https://any.run/report/cdbe87205b7a1a0833c158352d7c609f253573d5097ff29fa16ebd85f6b4a8f1/c3503bbf-f211-4166-8995-641d6d7c2800
- Public artifact URL https://any.run/report/09a0120f163c4797095fbd2be8a08b2f0fa9bfe1a8d7c996da6991562406be55/edac8446-a3da-41b4-9391-03a316f8bdbc
- Analyst observation The displayed phishing event was the CrossDomain rule's domain-level suspicion; no exact BioLink malware file, credential receiver, payload, or malware configuration was shown.
urlscan reported hundreds of recent records across the three related domains without a returned malicious verdict object. OTX associated biolink.info with 49 daily bulk pulses from one publisher and returned 89 URL observations with no Google Safe Browsing match. Current recent URLhaus and ThreatFox public data contained no exact related-domain match. Authentication-only, unavailable, or incomplete sources were treated as unknown rather than clean.
- Public artifact URL https://urlscan.io/domain/biolink.info
- Public artifact URL https://otx.alienvault.com/indicator/domain/biolink.info
- Analyst observation urlscan totals: biolink.info 309, biolink.website 367, biolink.site 239; no malicious verdict object was returned in the reviewed result sets.
- Analyst observation OTX for biolink.info: 49 pulses from one recurring bulk-list publisher; each reviewed pulse held about 2,000 indicators and did not identify a BioLink path or behavior. OTX returned 89 URL observations and zero Google Safe Browsing matches.
- Analyst observation Recent URLhaus and ThreatFox public datasets contained zero exact matches for the three related domains. Their authenticated APIs and other unavailable or incomplete sources were recorded as unknown, not clean.
- Public artifact URL https://github.com/MISP/misp-warninglists/blob/main/lists/link-in-bio/list.json
The Wayback index returned 7,950 successful collapsed records for biolink.info, 6,230 for biolink.website, and 719 for biolink.site. Sampled root captures from 2022, 2024, and 2026 consistently showed the BioLink link-in-bio service. The sampled roots did not expose an automatic malware download, credential receiver, or harmful payload, but archive coverage cannot certify all historical user paths.
- Public artifact URL https://web.archive.org/web/*/https://biolink.info/
- Analyst observation Successful collapsed index rows: biolink.info 7,950; biolink.website 6,230; biolink.site 719.
- Analyst observation Sampled root captures from 2022, 2024, and 2026 showed continuing BioLink operator content.
- Analyst observation The sampled roots did not reproduce a malware download, credential receiver, or harmful payload; unreviewed historical user paths remain outside the conclusion.
The three related operator domains resolved to the same current AWS-hosted address pool and served the same BioLink platform. Current certificate-transparency records showed one Amazon certificate covering the apex and wildcard names for biolink.info, biolink.website, and biolink.site. This supports shared service identity but does not establish the safety of every user-controlled path or outbound destination.
- DNS fact The related domains resolved within the same current AWS address pool, including 34.205.42.171, 35.153.107.78, 50.19.246.94, 54.161.183.51, 54.208.97.240, and 100.25.27.113.
- Certificate fact Amazon certificate transparency record: CN biolink.site; SANs include biolink.info, biolink.website, biolink.site, and their wildcard names; validity 2026-05-13 through 2026-11-26.
- Analyst observation Public example paths on biolink.site redirected to matching paths on biolink.info and returned BioLink user pages.
Scope and limitations
- No account was created, no authenticated area was entered, and no form was submitted during the review.
- The bounded crawler fetched public HTML and redirect chains but did not execute every page's JavaScript or interact with every control.
- External destinations linked by user pages were inventoried selectively and were not all followed or independently audited.
- Four candidate URLs containing characters that could not be encoded by the bounded crawler produced retrieval errors and were not treated as clean.
- Public URL-scan, sandbox, threat-intelligence, search, certificate, and archive indexes are finite. Authentication-only, unavailable, incomplete, or unindexed sources were treated as unknown rather than clean.
- Several exact paths cited in public sandbox records were no longer available, so their earlier content or behavior could not be reconstructed from the live site.
- The result applies to the operator surfaces and exact public objects reviewed at the recorded time. It does not certify every current, historical, future, private, or newly created user page or outbound destination.
- No current exact harmful URL, credential receiver, executable, malware sample, payload, or hash was supplied with the complaint beyond the root-domain blacklist screenshot.
Help protect others by sharing this page on social media! The more people who know about biolink.info, the fewer chances they have to deceive someone else. Help others evaluate biolink.info by sharing this page on social media!