bio[.]now

The domain bio.now was observed on July 23, 2026 as an active brand‑impersonation site targeting the Across brand. The site resolves to 185.111.111.157, an address announced by AS212238 (Datacamp Limited) located in Germany. Registration data shows the domain was created through 101domain GRS Limited, and the authoritative nameservers are mitch.ns.cloudflare.com and sima.ns.cloudflare.com, indicating use of Cloudflare DNS services. The website presents a page titled “Your Link in Bio Tool for Social Media | Bio.now” and returns HTTP status 200, confirming it is reachable.

TLS is provided by a Let’s Encrypt R12 certificate, which supplies encryption but no guarantee of legitimacy. VirusTotal scans have recorded twelve detections out of ninety‑three antivirus engines, and the domain appears on one security blocklist. AlienVault OTX lists the domain in twenty threat‑intel pulses, and both Gridinsoft and Scamadviser assign a trust score of 1 / 100, underscoring a high risk profile. Technical analysis reveals a PHP back‑end and inclusion of third‑party libraries such as Chart.js, Bootstrap, OWL Carousel, jsDelivr, jQuery UI, and the jQuery CDN, a stack frequently observed in low‑cost scam sites.

Defenders should block outbound traffic to 185.111.111.157, add bio.now to URL filtering and DNS sinkhole rules, and enable TLS inspection to detect any credential‑stealing activity. Because the domain relies on Cloudflare’s edge network, takedown efforts must target the hosting provider rather than the CDN, and monitoring of the associated IP range and Cloudflare nameservers is advised in case the operators shift infrastructure. Email security controls should flag messages referencing the “Your Link in Bio Tool” phrasing or the domain itself, and user awareness training should remind staff that the site is unrelated to any legitimate Across service.