Verdict
biolinky.co is low-trust and potentially risky.
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
| What this site appears to be | Product landing page for Biolinky, a link-in-bio SaaS offering free accounts, Pro upgrades, analytics, API/MCP for AI agents, and advertising opportunities. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 3 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 47 reports; shared hosting inflates reports | Clear |
| Domain age | 6.9 years oldRegistered history | Clear |
| Web archive | Archived since 2019471 snapshots | Clear |
| Certificate | Encrypted connectionIssued by YR2 | Noted |
The page as captured
No screenshot is retained for this report.
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: 3 to 10 years (registration continuity).
- Public web-archive history exists since 2019.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Overview
Biolinky is a link-in-bio SaaS platform presenting free accounts, paid Pro upgrades, customizable creator and brand pages, analytics, advertising placements, and API/MCP connectivity for managing profile content and campaigns.
Scam/Impersonation Risk
The site presents a coherent SaaS offering and the available page analysis found no confirmed brand impersonation, identity inconsistency, or phishing form behavior. However, the risk posture is materially affected by confirmed blacklist findings and multiple external malicious detections associated with the domain. Observed behavior also included suspicious inline scripts and elevated console errors; these signals do not independently establish fraud, but they reinforce the need to treat login, credential, and payment interactions as sensitive. The site's real-world operator remains unverified, so the credible product presentation should not be treated as proof of identity or legitimacy.
- External reputation evaluation recorded 3 malicious detections and 1 suspicious detection for the domain; the domain was also present on an external blacklist.
- The homepage is a product landing page with login and signup forms, but analysis found no hidden forms, external password submission, wallet-drainer activity, or detected brand impersonation.
- Browser behavior analysis recorded 2 suspicious inline scripts and 10 console errors across 2 successful runs.
- Domain registration continuity shows registration on 2019-09-19, with an age of 6.9 years.
- Web-archive coverage comprises 471 snapshots spanning 2019-12-14 through 2026-06-07, tracked across 8 years.
Regulatory Verification Notes
The business model is commercial software rather than a stated regulated financial service: the site describes free and Pro subscription tiers, advertising inventory, analytics, and optional API/MCP access using OAuth or personal API keys with separated read, write, and analytics permissions. No license, registration number, or licensing authority is claimed in the supplied site content, leaving the operator and contractual accountability insufficiently established for enterprise engagement. The homepage does provide navigation to terms and privacy pages, but the available evidence does not independently verify the legal entity behind those materials. A separate broker-reputation dataset reported no match; that is limited contextual information and is not a licensing or regulatory determination.
- The homepage states that monetization includes Pro upgrades and advertising opportunities and promotes API/MCP functions for AI-agent management.
- The homepage links to `/legal/terms` and `/legal/privacy`, alongside pricing, login, signup, and advertising pages.
- The site's transport encryption uses a DV certificate issued by YR2, valid to 2026-09-21T07:18:43+00:00.
What to Verify Next
Before any sensitive engagement, an institution should independently identify the operating legal entity through the terms, privacy, billing, and support materials and confirm that the contracting party matches the intended supplier. Any claimed corporate registration or sector-specific authorization should be checked directly with the relevant official registry. Login credentials should be unique to this service, and any subscription or advertising transaction should use payment methods with appropriate dispute and chargeback protections. API or AI-agent access should remain disabled until scopes, revocation behavior, data handling, and account-recovery procedures have been validated.
- The homepage offers account creation and login and separately promotes API/MCP access with OAuth or personal API keys.
- The pricing, advertising, terms, and privacy destinations provide the principal locations for checking commercial and data-processing obligations.
- The site presents claims including “Trusted by hundreds of thousands of creators and brands” and advertising estimates of “350K-500K imp./month”; these claims should be substantiated independently before commercial reliance.
Summary Verdict
The overall posture is low trust with elevated risk for sensitive interaction. The site's coherent SaaS presentation and stable operational characteristics do not offset the confirmed external reputation contradictions or the unresolved operator connection. It should not be treated as an established, independently verified service for credentialed, financial, or enterprise-sensitive use.
Infrastructure Integrity
The website is served through CDN/WAF infrastructure using edge address 76.76.21.21 on AS16509, operated by AMAZON-02 - Amazon.com, Inc., in the United States; the origin server was not observable. This protective edge architecture is a mitigating control for direct origin exposure, not evidence of legitimacy. The same shared provider IP carried 47 abuse reports, but it was whitelisted with a zero confidence score and the reports were explicitly discounted because they apply to shared infrastructure rather than being attributed specifically to Biolinky.
- Hosting is on AS16509 (AMAZON-02 - Amazon.com, Inc., US), with one observed CDN edge IP: 76.76.21.21.
- CDN/WAF resolution identified 1 edge IP and 0 likely origin candidates.
- The hosting infrastructure is registered through ARIN and resolved to the United States.
Closing Assessment
The appropriate institutional action is to defer credential, payment, and API-enabled engagement until independent operator, contractual, and reputation checks produce a satisfactory result; non-sensitive viewing may be limited to controlled review.
Written analysis generated 2026-08-13 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
2 findings contributed to this verdict, raised by registration and ownership, analysis engine, behaviour in a sandbox.
01 Governance Risk
- The registration record withholds contact details for the operator.Registration and ownership
rule:KF_WHOIS_HIDDEN - Registration details are held behind a privacy service, so no operator is named publicly. This is common and legal, and it also means there is nobody to check.Registration and ownership
rule:KF_WHOIS_PRIVATE
02 Sensitive Interaction Risk
- The analysis matched a pattern TrustSniffer treats as a direct threat to a visitor.Analysis engine
signal:direct_threat - The page carried inline scripts written in a style TrustSniffer treats as suspicious.Behaviour in a sandbox
rule:BEHAV_SUSPICIOUS_INLINE_SCRIPTS
Signals weighed against the site
- AbuseIPDB: 47 reports on hosting IP 76.76.21.21 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 25% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of biolinky.co.
- The request stayed on biolinky.co. It was not redirected to another domain. Clear
- Registration is published under Key-Systems GmbH. Clear
- DNS for this domain is served by transip.nl, across 3 name servers. Noted
- The registration is paid up to 2026-09-19. Noted
- The earliest public archive of this site is from 2019-12-14. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Key-Systems GmbH |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 76.76.21.21 |
| Name servers | NS1.TRANSIP.NL, NS2.TRANSIP.EU, NS0.TRANSIP.NET |
| SSL issuer | YR2 |
| SSL expiry | 2026-09-21 |
| Domain age | 6.90 years (continuous registration) |
| Domain expiry | 2026-09-19 |
| Archive first seen | 2019-12-14 |
| Archive snapshots | 471 |
| Reputation | VirusTotal: 3 flagged | AbuseIPDB: 0% confidence, 47 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about biolinky.co at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.