truenow[.]io

On July 24 2026 the domain truenow.io was observed as offline, returning a Cloudflare‑generated 522 “Connection timed out” page title. The domain was registered on 26 November 2025 through NiceNIC International Group Co., Limited and is delegated to the Cloudflare nameservers aldo.ns.cloudflare.com and ximena.ns.cloudflare.com. DNS resolution points to the address 172.67.161.90, which belongs to AS13335 Cloudflare, Inc. in the United States. No SSL certificate is presented for the host, indicating that HTTPS was not configured at the time of observation. Threat intelligence sources flag truenow.io as part of an “Airdrop Scam” phishing kit.

Three of ninety‑five security vendors on VirusTotal marked the domain as malicious, and the domain appears on a single security blocklist. PhishDestroy has also listed the domain as blocked. The Gridinsoft trust score is 0 out of 100, reinforcing the low credibility assessment. The available data confirm that the infrastructure relies on Cloudflare’s CDN and DDoS protection services, which can obscure the true origin of the malicious actor.

No further evidence regarding the page content, credential‑stealing modules, or targeted brands has been disclosed; therefore the specific payload or victim interaction remains uncertain. Defenders should continue to block truenow.io at network perimeter, add the domain to URL filtering and endpoint protection policies, and monitor for any resurgence of activity. Continued observation of the associated IP address and the Cloudflare nameservers is advised, as threat actors may repoint the domain to new hosting while retaining the same registration details. Organizations employing mail filters or web gateways should ensure that alerts from the three VirusTotal detections are treated with elevated priority, given the elevated risk rating.