biolinks[.]ae

Analysis of biolinks.ae, created on February 21 2026, shows a high‑risk brand‑impersonation campaign targeting MetaMask users. The site presents a page title of "BioLinks – INTERNATIONAL FZE" and is hosted on an Apache HTTP Server responding with HTTP status 200. Infrastructure inspection reveals the domain resolves to IP address 192.185.194.1, which belongs to AS19871 Network Solutions, LLC in the United States. The TLS certificate is issued by Let’s Encrypt (R12), indicating a valid but freely obtained certificate.

Nameserver records point to ns1379.websitewelcome.com and ns1380.websitewelcome.com, typical of shared hosting environments. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a wallet/seed phishing operation. VirusTotal reports a single detection out of 93 scanning engines, confirming at least one vendor has flagged the domain as malicious.

While the exact phishing page content has not been disclosed, the combination of brand impersonation, wallet‑seed phishing intent, and active blocklist listings suggests a credible threat to MetaMask users. Defenders should block DNS resolution for biolinks.ae, monitor outbound connections to its hosting IP, and enforce strict URL filtering for any requests matching the domain. Users should be warned against entering MetaMask credentials or seed phrases on this site, and incident response teams should consider the domain compromised and add it to internal threat intel feeds for ongoing surveillance.