context safety score
A score of 39/100 indicates multiple risk signals were detected. This entity shows patterns commonly associated with malicious intent.
phishing
2 deceptive links where visible host does not match destination host
malicious redirect
The page is served from eugwae.za.com but the canonical URL, all og: meta tags, all internal links, and all assets point to esorbit.in.net. The HTML <link rel="alternate" media="only screen and (max-width: 640px)"> redirects mobile users to lc88-game.bio — a different third-party domain. The serving domain (eugwae.za.com) is completely decoupled from the displayed brand identity, indicating a redirect/cloaking layer is in use to funnel traffic from the scanned domain to the actual gambling site. (location: page.html line 15-16, <link rel="canonical"> and <link rel="alternate">)
phishing
The site presents itself as the official homepage of online gambling platform LC88 (LC88.COM) but is actually served from eugwae.za.com — an unrelated domain. All registration and login buttons link to https://www.lc88.life/register?affiliateCode=rice001, a third domain distinct from both the scanned domain and the canonical domain. Users believing they are visiting the legitimate LC88.COM are instead routed through an affiliate link on an unaffiliated domain, constituting a phishing/affiliate-fraud setup that harvests registrations under a fraudulent affiliate code. (location: page.html lines 481-492, header registration/login buttons with affiliateCode=rice001)
social engineering
The page employs fabricated social proof: fake player testimonials with named individuals (Hân Phan, Nguyễn Vinh, Đăng Tài), inflated membership claims (4.5 million registered accounts, 95% active rate), and a self-authored 4.9/5 aggregate rating with only 123 reviews attributed to the brand itself as author. The content is designed to manufacture trust and urgency to drive account registration and financial deposits on an unregulated gambling platform. (location: page.html lines 1062-1070, page-text.txt lines 629-631)
social engineering
The FAQ section actively instructs users to circumvent geo-blocks using VPN or the app download to register accounts — explicitly advising on bypassing legal restrictions. This social engineering normalises illegal activity and encourages users in prohibited jurisdictions to evade detection while handing over personal and financial data. (location: page.html lines 1289-1292, page-text.txt lines 852-855)
brand impersonation
The site impersonates LC88.COM, displaying its branding, logo, and content while being hosted on eugwae.za.com (scanned URL) with a canonical set to esorbit.in.net. The page title and structured data claim the identity 'LC88 | Trang Chủ LC88.COM' — directly impersonating the brand name and official domain (LC88.COM) on an unaffiliated infrastructure to capture organic search traffic and user registrations. (location: page.html line 12 (title), lines 77-144 (JSON-LD schema claiming LC88 identity on esorbit.in.net))
malicious redirect
All call-to-action buttons labeled 'ĐĂNG KÝ' (Register) and 'ĐĂNG NHẬP' (Login) link to https://www.lc88.life/register?affiliateCode=rice001 — a domain different from both the scanned domain and the displayed canonical URL. Users interacting with what appears to be an LC88 site are silently redirected to lc88.life with an embedded affiliate tracking code (rice001), monetising the deceptive traffic. (location: page.html lines 481-492, 534-546)
hidden content
The page includes a collapsible content block (.rut_gon) that hides text below 350px height behind a JavaScript-controlled 'Xem thêm' (See more) button. This technique can conceal text from casual review while remaining accessible to search engine crawlers — a cloaking/SEO spam tactic. Additionally, the Cloudflare email obfuscation script encodes the contact email address, preventing straightforward extraction. (location: page.html lines 1552-1643 (.rut_gon JavaScript), line 1461 (Cloudflare email obfuscation via __cf_email__))
curl https://api.brin.sh/domain/eugwae.za.comCommon questions teams ask before deciding whether to use this domain in agent workflows.
eugwae.za.com currently scores 39/100 with a suspicious verdict and low confidence. The goal is to protect agents from high-risk context before they act on it. Treat this as a decision signal: higher scores suggest lower observed risk, while lower scores mean you should add review or block this domain.
Use the score as a policy threshold: 80–100 is safe, 50–79 is caution, 20–49 is suspicious, and 0–19 is dangerous. Teams often auto-allow safe, require human review for caution/suspicious, and block dangerous.
brin evaluates four dimensions: identity (source trust), behavior (runtime patterns), content (malicious instructions), and graph (relationship risk). Analysis runs in tiers: static signals, deterministic pattern checks, then AI semantic analysis when needed.
Identity checks source trust, behavior checks unusual runtime patterns, content checks for malicious instructions, and graph checks risky relationships to other entities. Looking at sub-scores helps you understand why an entity passed or failed.
brin performs risk assessments on external context before it reaches an AI agent. It scores that context for threats like prompt injection, hijacking, credential harvesting, and supply chain attacks, so teams can decide whether to block, review, or proceed safely.
No. A safe verdict means no significant risk signals were detected in this scan. It is not a formal guarantee; assessments are automated and point-in-time, so combine scores with your own controls and periodic re-checks.
Re-check before high-impact actions such as installs, upgrades, connecting MCP servers, executing remote code, or granting secrets. Use the API in CI or runtime gates so decisions are based on the latest scan.
Learn more in threat detection docs, how scoring works, and the API overview.
Assessments are automated and may contain errors. Findings are risk indicators, not confirmed threats. This is a point-in-time assessment; security posture can change.
integrate brin in minutes — one GET request is all it takes. query the api, browse the registry, or download the full dataset.