context safety score
A score of 35/100 indicates multiple risk signals were detected. This entity shows patterns commonly associated with malicious intent.
encoded payload
suspicious base64-like blobs detected in page content
cloaking
Page conditionally redirects based on referrer or user-agent
cloaking
Page loads content in transparent or zero-size iframe overlay
js obfuscation
JavaScript uses eval() with String.fromCharCode — common obfuscation
js obfuscation
JavaScript uses Function constructor for runtime code generation
obfuscated code
Large eval()-based obfuscated JavaScript block present in the NETZME payment script section. Uses a custom base-conversion encoder (_0xe57c) followed by a self-executing eval() with heavily encoded string payload. The actual runtime behavior is hidden and cannot be statically determined. (location: page.html:line 169 (NETZME script block))
malicious redirect
A JavaScript function OpenInNewTab() hardcodes a redirect to 'https://english.gossip-lankanews.com/register' — a domain unrelated to toto12atlanta.net or toto12core.com. This silently sends users to a third-party registration page, potentially for credential harvesting or affiliate fraud. (location: page.html:line 219-222)
malicious redirect
The 'Lupa Password' (Forgot Password) link is dynamically rewritten via jQuery to redirect to 'https://kitakale.me/TELEGRAMTOTO12' instead of the site's own /forgot/password page. Users seeking account recovery are silently diverted to an external Telegram link — a social engineering vector for credential theft. (location: page.html:line 2021 / page-text.txt:line 1702)
credential harvesting
The QRIS deposit flow injects a hidden iframe loading content from 'https://olx.recamweek.com/TOTO12/Hk4REua.png' and immediately posts the logged-in username via postMessage with wildcard origin ('*'): contentWindow.postMessage('{"username":"..."}', '*'). This exfiltrates the current session username to a third-party domain with no origin restriction. (location: page.html:lines 1775-1779)
hidden content
An external script is loaded from 'https://olx.recamweek.com/snackbarmobile.js' — a third-party domain (recamweek.com) not affiliated with the site. The script's content is unknown and executes in the page context with full DOM access. Combined with the iframe from the same domain, this represents a persistent third-party code injection point. (location: page.html:line 1675)
social engineering
The site uses a fake animated progressive jackpot counter (IDR 1,131,665,972+) that auto-increments every 100ms via setInterval to simulate a growing prize pool. This is a fabricated urgency/reward manipulation technique designed to pressure users into depositing funds into an illegal gambling platform. (location: page.html:lines 1552-1566)
hidden content
Developer tools are actively blocked: Ctrl+Shift+I, Ctrl+U, F12, and right-click context menu are all suppressed via event listeners. This anti-inspection behavior is used to conceal obfuscated scripts and malicious code from security researchers and users. (location: page.html:lines 92-108 and 1727-1743)
malicious redirect
The canonical URL points to 'https://toto12core.com' while the page is served from toto12atlanta.net. The amphtml link points to 'https://pizzasunday.info/linkutama/' — an unrelated domain used as an AMP alternate, potentially for SEO manipulation or redirect chaining to alternate gambling mirror sites. (location: page.html:lines 4 and 12)
social engineering
The site presents a feedback/survey form via a popup window pointing to 'https://form.6mbr.com/?webname=english.gossip-lankanews.com&lang=id'. The webname parameter references gossip-lankanews.com (a different site), indicating the feedback infrastructure is shared across multiple gambling/spam sites and may harvest user data beyond what is disclosed. (location: page.html:lines 310-313)
prompt injection
Multiple Google Site Verification meta tags (15 entries) are present for a single domain. This is abnormal and suggests the domain may be used for SEO manipulation, potentially to boost search ranking for gambling keywords and make the site appear more legitimate to automated crawlers and AI-based content classifiers. (location: page.html:lines 76-90)
curl https://api.brin.sh/domain/toto12atlanta.netCommon questions teams ask before deciding whether to use this domain in agent workflows.
toto12atlanta.net currently scores 35/100 with a suspicious verdict and low confidence. The goal is to protect agents from high-risk context before they act on it. Treat this as a decision signal: higher scores suggest lower observed risk, while lower scores mean you should add review or block this domain.
Use the score as a policy threshold: 80–100 is safe, 50–79 is caution, 20–49 is suspicious, and 0–19 is dangerous. Teams often auto-allow safe, require human review for caution/suspicious, and block dangerous.
brin evaluates four dimensions: identity (source trust), behavior (runtime patterns), content (malicious instructions), and graph (relationship risk). Analysis runs in tiers: static signals, deterministic pattern checks, then AI semantic analysis when needed.
Identity checks source trust, behavior checks unusual runtime patterns, content checks for malicious instructions, and graph checks risky relationships to other entities. Looking at sub-scores helps you understand why an entity passed or failed.
brin performs risk assessments on external context before it reaches an AI agent. It scores that context for threats like prompt injection, hijacking, credential harvesting, and supply chain attacks, so teams can decide whether to block, review, or proceed safely.
No. A safe verdict means no significant risk signals were detected in this scan. It is not a formal guarantee; assessments are automated and point-in-time, so combine scores with your own controls and periodic re-checks.
Re-check before high-impact actions such as installs, upgrades, connecting MCP servers, executing remote code, or granting secrets. Use the API in CI or runtime gates so decisions are based on the latest scan.
Learn more in threat detection docs, how scoring works, and the API overview.
Assessments are automated and may contain errors. Findings are risk indicators, not confirmed threats. This is a point-in-time assessment; security posture can change.
integrate brin in minutes — one GET request is all it takes. query the api, browse the registry, or download the full dataset.