context safety score
A score of 43/100 indicates multiple risk signals were detected. This entity shows patterns commonly associated with malicious intent.
encoded payload
suspicious base64-like blobs detected in page content
cloaking
Page conditionally redirects based on referrer or user-agent
cloaking
Page loads content in transparent or zero-size iframe overlay
js obfuscation
JavaScript uses Function constructor for runtime code generation
obfuscated code
The ad configuration script explicitly references 'adver':'7.10.13.hommy.obfuscated.js' and loads a dynamically constructed obfuscated script: 'https://js.txxx.tube/flytrain/exort7.10.13.415a150d8ca331c798f49c864e02c543.js'. The filename contains a hash and is consistent with obfuscated payload delivery for ad/tracking purposes. (location: page.html:58-60)
malicious redirect
Geo-targeted forced redirects (window.force_url) are set for users in Ukraine ('ua'), South Korea ('kr'), and France ('fr') country codes, directing them to opaque tracking URLs at 'directsle.com' with long encrypted/encoded parameters. These redirects are injected into the popunder system and fire without user consent. (location: page.html:127-139)
malicious redirect
Push notification subscription interstitial uses 'subInterstitialSettings.directLink' pointing to 'https://online-hd.amazingcontent.site/?tag_id=93577&cl=3&click=1' — an unrelated third-party domain with suspicious naming used as a direct redirect when users interact with push prompts. (location: page.html:62)
social engineering
A timed content-locking button labeled 'UNLOCK FULL' (and temporarily overridden to 'AI Porn Video' until 2026-03-21) is programmatically injected over video content. Users are socially engineered into clicking to 'unlock' content, which redirects them to affiliate/adult subscription sites (cmonbae.com, g2fame.com, javhd.com, kink.com, etc.). (location: page.html:77-101)
social engineering
Tab-link advertisements use deceptive labels mimicking popular platforms: '🩷TikTok Porn' (linking to as.fontheader.com) and '🔥№1 PORN GENERATOR' / '🔥AI porn' (linking to nudeai.fun and candyai.gg). These brand-adjacent titles are designed to lure clicks under false pretenses. (location: page.html:157-213)
brand impersonation
Tab-link labeled '🩷TikTok Porn' exploits the TikTok brand name to drive traffic to 'https://as.fontheader.com/as/nl?p=tubecorporate&v=10662', which is unaffiliated with TikTok. This constitutes brand impersonation to increase click-through rates. (location: page.html:197-201)
hidden content
Yandex Metrika tracking pixels are placed at position 'left:-9999px' (off-screen) in noscript tags, silently tracking users even without JavaScript. Additionally, multiple invisible tracking pixels are dynamically appended to the document body, operating outside the user's visible page area. (location: page.html:37-39)
hidden content
A large base64-encoded SVG icon is embedded inside a JavaScript comment within window._hl configuration. While currently commented out, it represents hidden/encoded content that could be activated. The encoded blob is non-trivially long and obscures what graphic is being used in the ad button. (location: page.html:159)
malicious redirect
Popunder/tabunder ad system with 'popunder_type: tabunder' and frequency set to 999999 is configured to open new browser tabs redirecting to third-party ad networks (ExoClick zone 765037, bartcons.com, pemsrv.com) triggered by any click on video player elements or listing items — aggressive and deceptive redirect mechanism. (location: page.html:493-552)
social engineering
The 'delegate-ch' meta tag delegates full client-hint headers (UA string, platform, architecture, model, bitness, full version list) to 'tsyndicate.com', a third-party ad syndication domain. This silently harvests detailed browser fingerprinting data on behalf of an external party without clear user disclosure. (location: page.html:45)
hidden content
The adver configuration variable 'chAm2MphS9' uses a randomly generated-looking key name and contains encoded RTB controller path ('txxx/txxCtrl.js?v=4.3') and a VAST ad server URL, making the ad infrastructure difficult to audit or block. Variable obfuscation via random naming is a known evasion technique. (location: page.html:57-58)
curl https://api.brin.sh/domain/txxx.comCommon questions teams ask before deciding whether to use this domain in agent workflows.
txxx.com currently scores 43/100 with a suspicious verdict and low confidence. The goal is to protect agents from high-risk context before they act on it. Treat this as a decision signal: higher scores suggest lower observed risk, while lower scores mean you should add review or block this domain.
Use the score as a policy threshold: 80–100 is safe, 50–79 is caution, 20–49 is suspicious, and 0–19 is dangerous. Teams often auto-allow safe, require human review for caution/suspicious, and block dangerous.
brin evaluates four dimensions: identity (source trust), behavior (runtime patterns), content (malicious instructions), and graph (relationship risk). Analysis runs in tiers: static signals, deterministic pattern checks, then AI semantic analysis when needed.
Identity checks source trust, behavior checks unusual runtime patterns, content checks for malicious instructions, and graph checks risky relationships to other entities. Looking at sub-scores helps you understand why an entity passed or failed.
brin performs risk assessments on external context before it reaches an AI agent. It scores that context for threats like prompt injection, hijacking, credential harvesting, and supply chain attacks, so teams can decide whether to block, review, or proceed safely.
No. A safe verdict means no significant risk signals were detected in this scan. It is not a formal guarantee; assessments are automated and point-in-time, so combine scores with your own controls and periodic re-checks.
Re-check before high-impact actions such as installs, upgrades, connecting MCP servers, executing remote code, or granting secrets. Use the API in CI or runtime gates so decisions are based on the latest scan.
Learn more in threat detection docs, how scoring works, and the API overview.
Assessments are automated and may contain errors. Findings are risk indicators, not confirmed threats. This is a point-in-time assessment; security posture can change.
integrate brin in minutes — one GET request is all it takes. query the api, browse the registry, or download the full dataset.