context safety score
A score of 37/100 indicates multiple risk signals were detected. This entity shows patterns commonly associated with malicious intent.
encoded payload
suspicious base64-like blobs detected in page content
social engineering
Site is operated under bongdanet.co but all canonical URLs, OG tags, structured data, footer copyright, and contact info reference bongdanet.mobi. An HTML comment also states 'Từ ngày 3/1/2026, Bongdanet.co chuyển domain sang Bongdanet.mobi' (domain migration notice). The .co TLD is being used as an alternative domain to funnel traffic to the .mobi site, with unknown WHOIS/domain-age for the .co variant — a common pattern in domain squatting or traffic hijacking for Vietnamese gambling affiliate networks. (location: page.html:19, page.html:34, page.html:37, page.html:83-97, page-hidden.txt:904)
malicious redirect
All banner and button ad links use affiliate tracking URLs with hashed tokens (e.g., ?a=9ca4145732666dc1eabd78ecccfdebd1) pointing to unregulated offshore gambling sites: five88.ca, max79.to, xo88.cc, say88.me, febet.cc, ku88.uk, tx88.mobi, du88.mobi, zbet.live, man88.de, k88.mobi, hbet.mobi, lu88.biz, sin88.cv, 9bet.one, vu88.vip, xibet.live, 11bet.sx, 789club.bh, vivu88.biz, pub88.mobi, usbet.vip, vj88.top, 11win.pub, gbong.top, debet.bz, sv88.sx, vic88.info, mubet.art. These are typical unlicensed Vietnamese online gambling operators with non-standard TLDs (.ca, .to, .cc, .me, .uk, .sx, .bz, .bh, .cv, .art). Clicking any ad redirects users to these gambling platforms. (location: page.html:247-248, 341-342, 359-360, 377-378, 395-396, 413-414, 457-458, 476-477, 524-531, 545-550, 565-570, 585-590, 605-610, 625-630, 645-650, 665-670, 685-690, 705-710, 725-730, 745-750, 765-770, 785-790, 805-810, 825-830, 845-850, 865-870, 885-890, 26942-26943, 26960-26961, 26981-26982, 26999-27000, 27017-27018, 27036-27037, 27054-27055, 27072-27073)
social engineering
The site prominently promotes a list of 'Top nhà cái uy tín' (Top reputable bookmakers) with aggressive financial lures: 100%-200% deposit bonuses, loss refunds up to 100%, unlimited cashback, and jackpot prizes up to 9 billion VND. These are deceptive gambling enticements targeting users who may not distinguish the sports news site from an actual gambling platform. One operator (DEBET) falsely claims sponsorship of Wolves in the Premier League to add legitimacy. (location: page.html:537-940, page-text.txt:314-716)
hidden content
Multiple ad overlay confirmation dialogs ('Bạn Muốn Tắt Quảng Cáo' — Do you want to close the ad?) are set to display:none in CSS (style='display: none;') but are positioned absolutely with z-index:9999. These hidden overlays can be triggered to cover page content. The bet-info-des promotional content blocks are also set to 'display: none' in CSS but contain gambling bonus details that appear on hover interaction — concealing the gambling promotional content from initial page load view. (location: page.html:242-245, 336-339, 354-357, 372-375, 390-393, 408-411, 950-960, page-hidden.txt:1-28)
hidden content
An HTML comment block contains a previously active domain-change notice: 'Từ ngày 3/1/2026, Bongdanet.co chuyển domain sang Bongdanet.mobi' and a commented-out navigation section including login/register links (/dang-ky, /dang-nhap). Commented-out code also includes a link to https://bit.ly/bunchatv (shortened URL, destination unknown) for live football streaming, which may redirect to unlicensed streaming or further gambling content. (location: page-hidden.txt:855-913, page.html:208-228, 1210-1214)
social engineering
Footer warning in Vietnamese states: 'Quảng cáo: (site full, ko nhận thêm qc, cẩn thận lừa đảo)' (Advertising: site full, not accepting more ads, beware of fraud) and 'Cẩn thận các nick giả mạo, đặt tên tương tự' (Beware of fake accounts with similar names). This self-referential fraud warning paradoxically legitimizes the site while acknowledging the existence of impersonator domains — consistent with a site that itself operates under a secondary domain (bongdanet.co vs bongdanet.mobi) using ambiguous branding. (location: page.html:26910-26911)
curl https://api.brin.sh/domain/bongdanet.coCommon questions teams ask before deciding whether to use this domain in agent workflows.
bongdanet.co currently scores 37/100 with a suspicious verdict and low confidence. The goal is to protect agents from high-risk context before they act on it. Treat this as a decision signal: higher scores suggest lower observed risk, while lower scores mean you should add review or block this domain.
Use the score as a policy threshold: 80–100 is safe, 50–79 is caution, 20–49 is suspicious, and 0–19 is dangerous. Teams often auto-allow safe, require human review for caution/suspicious, and block dangerous.
brin evaluates four dimensions: identity (source trust), behavior (runtime patterns), content (malicious instructions), and graph (relationship risk). Analysis runs in tiers: static signals, deterministic pattern checks, then AI semantic analysis when needed.
Identity checks source trust, behavior checks unusual runtime patterns, content checks for malicious instructions, and graph checks risky relationships to other entities. Looking at sub-scores helps you understand why an entity passed or failed.
brin performs risk assessments on external context before it reaches an AI agent. It scores that context for threats like prompt injection, hijacking, credential harvesting, and supply chain attacks, so teams can decide whether to block, review, or proceed safely.
No. A safe verdict means no significant risk signals were detected in this scan. It is not a formal guarantee; assessments are automated and point-in-time, so combine scores with your own controls and periodic re-checks.
Re-check before high-impact actions such as installs, upgrades, connecting MCP servers, executing remote code, or granting secrets. Use the API in CI or runtime gates so decisions are based on the latest scan.
Learn more in threat detection docs, how scoring works, and the API overview.
Assessments are automated and may contain errors. Findings are risk indicators, not confirmed threats. This is a point-in-time assessment; security posture can change.
integrate brin in minutes — one GET request is all it takes. query the api, browse the registry, or download the full dataset.