sh420real.fans.link

https://sh420real.fans.link/

104.26.14.117 · Cloudflare, Inc.

Location

Toronto, Canada

Domain Age

2497 days

HTTP

200 · 31.8s

SSL

Valid· WE1, Google Trust Services, US

Status

COMPLETED

Visual Evidence

Zoom

Title: "SH420REAL - Linkbio | Instabio"

Save

Registered-domain escalation

Submit fans.link as the primary IOC, enriched with evidence from hostile subdomains like sh420real.fans.link.

KB/IOK Matches (0)—

No KB/IOK detections were recorded for this scan.

SH420REAL / fans.link (Linkbio/Instabio landing page)

Unknown

Technology · 7/19/2026

Summary

The page presents branding that resembles a personal link hub (SH420REAL) hosted under sh420real.fans.link, with multiple InstaBio-like assets loaded from bio.linkcdn.cc. The page title and assets point to a generic link-in-bio service rather than a well-known brand; however, the visual heavy impersonation signals a potential clone of a popular link-in-bio/Instabio interface. No explicit credential harvesting form is visible in the static HTML, and the form fields are not present in the source; the SPA nature suggests credential UI could be rendered client-side. POST requests to Google Analytics and a second analytics endpoint indicate data collection but do not by themselves prove credential phishing. Overall, evidence shows branding consistent with a clone or spoofed link-in-bio page rather than a definitive first-party abuse, but the strong impersonation cues in the visuals require cautious handling.

Evidence Summary

▸Observed 3 capture stage(s); canonical stage is late_render_3s.

▸POST targets observed during capture: https://www.google-analytics.com/g/collect?v=2&tid=G-CZLXMY5GVR&gtm=45je65r2h1v893892725za200zd893892725&_p=1780329434810&gcd=13l3l3l3l1l1&npa=0&dma=0&are=1&cid=1974262113.1780329435&frm=0&pscdl=noapi&rcb=8&sr=1280x720&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CHeadlessChrome%3B145.0.7632.6%7CChromium%3B145.0.7632.6&uam=&uamb=0&uap=Windows&uapv=10.0&uaw=0&ul=en-us&_s=1&tag_exp=0~115616986~115938466~115938469~119034491~119064591&sid=1780329435&sct=1&seg=0&dl=https%3A%2F%2Fsh420real.fans.link%2F&dt=SH420REAL%20-%20Linkbio%20%7C%20Instabio&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1382, https://sapi.instabio.cc/v/2.3/anl/adata/link/8021113ZkXGDR/sh420real/link/?.

▸Distinctive asset clues: base1.js, optmpl.js, default.css, css2, blank.png, favicon160.png.

Capture

Stages: 3

Canonical: Late Render (+3s)

Changed: No

Credential Signals

Forms: 0

Password fields: 0

Late-stage login UI: No

Resource Signals

Resources: 40

Hosts: 8

Domains: 8

Attack Techniques (3)

Single-Page Application (SPA) rendering forms via JavaScript (0 static forms in HTML but 11 scripts loaded, suggesting credential UI could be injected at runtime)External analytics collection (Google Analytics) and potential data exfiltration endpoints observed in network activityVisual impersonation cues in screenshot: large branded hero image and UI elements resembling a familiar link-in-bio/dashboard aesthetic

Indicators of Compromise (0)

No specific IOCs identified in source

Risk AssessmentUsed in abuse reports

The site uses a visually branded interface that imitates a popular link-in-bio service, hosted on a non-official domain. While there is no static credential form detected in the HTML, the SPA nature and third-party asset loading strongly suggest credential collection could occur via JavaScript-rendered UI. The presence of impersonation cues in visuals, coupled with analytics data collection to Google Analytics and a branded Instabio pathway, indicates potential phishing risk if users are deceived into entering credentials. Recommend ongoing monitoring and confirmation of brand legitimacy; the current data does not definitively show credential harvesting but indicates impersonation risk.

Recommended Action

Monitor

Cross-Reference8

URL Intelligence