context safety score
A score of 33/100 indicates multiple risk signals were detected. This entity shows patterns commonly associated with malicious intent.
encoded payload
suspicious base64-like blobs detected in page content
phishing
1 deceptive links where visible host does not match destination host
obfuscated code
Highly obfuscated JavaScript in the first <script> tag uses a multi-layer obfuscation scheme: URL-encoded string decoding, character rotation cipher (Caesar-style with position-dependent offsets), array slicing by precomputed index offsets, and dynamic property/function resolution. The script dynamically constructs URLs and function references at runtime, making its true payload (likely ad-injection, traffic redirection, or fingerprinting) impossible to determine from static analysis. Loaded unconditionally with data-cfasync='false' to bypass Cloudflare's rocket-loader scrutiny. (location: page.html:12 — first inline <script> block, immediately before <meta charset>)
malicious redirect
External script loaded from driverhugoverblown.com — a domain with a clearly synthetic/randomised name consistent with malvertising infrastructure. Loaded asynchronously with data-cfasync='false' (bypassing Cloudflare scanning) and wired to the obfuscated obgow() dispatcher via both onerror and onload handlers. This pattern is a canonical drive-by redirect / popunder ad delivery mechanism used in adult traffic monetisation networks known to chain into malware and credential-harvesting landers. (location: page.html:13 — <script src='//driverhugoverblown.com/on.js'>)
obfuscated code
Second obfuscated JavaScript block in the page footer uses a hexadecimal string-array rotation loop (while(!![]){...push/shift anti-tamper pattern}) combined with MD5 implementation and obfuscated property names assembled from concatenated substrings. The decoded logic constructs a 'adMaNager' (ad manager) endpoint path and makes date-stamped requests, consistent with covert ad/tracking beacon injection or affiliate cookie stuffing. Loaded with data-cfasync='false'. (location: page.html:1978 / page-text.txt:1819 — footer <script data-cfasync='false'> block)
brand impersonation
The site operates under the URL masafun.com but presents its brand inconsistently across multiple identities: title tags claim 'MasaLoL.Com', og:site_name switches between 'MasaFun.Net' and empty string, the author meta tag references '[b]Masahub.com[/b]', and the copyright footer reads 'LOL-MF©2026 MasaLoL.Com'. This deliberate multi-brand identity confusion is used to impersonate or trade off the reputations of masahub.com, masafun.net, and masalol.com simultaneously, siphoning SEO equity and misleading users/crawlers about which site they are actually visiting. (location: page.html:17,24,27,80,97,110,141,160,1977)
hidden content
Multiple ad-network site-verification tokens are embedded that are not visible to users but expose the site's full monetisation stack: HilltopAds (×2), Clickaine (×2, duplicate token), DaoPush, ExoClick, and maValidation (×2). These networks are well-documented conduits for malvertising, push-notification spam, and popunder/redirect campaigns targeting adult traffic. Their presence confirms the obfuscated scripts are wired to these networks. (location: page.html:68–78 — meta verification tags (hilltopads-site-verification, clickaine-site-verification, daopush-site-verification, exoclick-site-verification, maValidation))
social engineering
The site presents itself as a free video streaming platform ('Watch free new porn videos') while silently running at least four obfuscated ad-network scripts. Users are lured with free content while being subjected to drive-by ad delivery, push-notification subscription prompts (DaoPush, Clickaine), and potential redirect chains — a classic bait-and-switch social engineering model used to harvest push-notification subscriptions and deliver unwanted software. (location: page.html:18,24 — meta description and og:description; corroborated by ad-network verification tags)
malicious redirect
Assets (CSS, JS, images) are loaded from cdn-mfun.b-cdn.net and mhub2.b-cdn.net — BunnyCDN pull zones under operator control — and init.js is loaded from cdn-mfun.b-cdn.net without subresource integrity (SRI) checks. These CDN-hosted scripts can be silently updated to inject redirects or malicious payloads without any change to the page HTML, and cannot be audited from the static page source alone. (location: page.html:125-126 — <script src='https://cdn-mfun.b-cdn.net/js/init.js?v=1.0.5'>)
hidden content
The page uses duplicate id='ajax_content' on two sibling <div> elements (Trending and Latest sections). While likely a WordPress theme bug, duplicate IDs combined with the jQuery .load() AJAX content-injection pattern (which targets '#ajax_content' to replace page content) creates an ambiguous DOM state that could be exploited to inject or swap content sections without user awareness, and may confuse AI agents parsing the page structure. (location: page.html:272,1096 — id='ajax_content' used twice on separate section divs)
curl https://api.brin.sh/domain/masafun.comCommon questions teams ask before deciding whether to use this domain in agent workflows.
masafun.com currently scores 33/100 with a suspicious verdict and low confidence. The goal is to protect agents from high-risk context before they act on it. Treat this as a decision signal: higher scores suggest lower observed risk, while lower scores mean you should add review or block this domain.
Use the score as a policy threshold: 80–100 is safe, 50–79 is caution, 20–49 is suspicious, and 0–19 is dangerous. Teams often auto-allow safe, require human review for caution/suspicious, and block dangerous.
brin evaluates four dimensions: identity (source trust), behavior (runtime patterns), content (malicious instructions), and graph (relationship risk). Analysis runs in tiers: static signals, deterministic pattern checks, then AI semantic analysis when needed.
Identity checks source trust, behavior checks unusual runtime patterns, content checks for malicious instructions, and graph checks risky relationships to other entities. Looking at sub-scores helps you understand why an entity passed or failed.
brin performs risk assessments on external context before it reaches an AI agent. It scores that context for threats like prompt injection, hijacking, credential harvesting, and supply chain attacks, so teams can decide whether to block, review, or proceed safely.
No. A safe verdict means no significant risk signals were detected in this scan. It is not a formal guarantee; assessments are automated and point-in-time, so combine scores with your own controls and periodic re-checks.
Re-check before high-impact actions such as installs, upgrades, connecting MCP servers, executing remote code, or granting secrets. Use the API in CI or runtime gates so decisions are based on the latest scan.
Learn more in threat detection docs, how scoring works, and the API overview.
Assessments are automated and may contain errors. Findings are risk indicators, not confirmed threats. This is a point-in-time assessment; security posture can change.
integrate brin in minutes — one GET request is all it takes. query the api, browse the registry, or download the full dataset.