context safety score
A score of 37/100 indicates multiple risk signals were detected. This entity shows patterns commonly associated with malicious intent.
malicious redirect
script/meta redirect patterns detected in page source
malicious redirect
All banner ad clicks are routed through an on-site click-tracking redirect endpoint (/click?id=XX&url=...) before forwarding users to third-party gambling and adult sites. The destination URLs are URL-encoded, obscuring the final destination from users and link-preview tools. Destinations include offshore gambling platforms such as bet38join.com, kcasinojoin.com, spd-7575.com, daemul-10.com, ok-8888.com, kplay.casino, and others. (location: page.html lines 709-877, banner ad section)
social engineering
The page fabricates a fake academic author ('김수진 박사' / Dr. Kim Su-jin) claiming 12+ years of research in sex education and psychology, artificially manufactured user reviews with crude usernames, and fabricated statistics ('70% of 야동코리아 users now use 야동티비') to manufacture trust and legitimacy for an illegal/unlicensed adult content aggregator site operating in South Korea where such sites are blocked. (location: page.html lines 1229-1411, page-text.txt lines 979-1161)
social engineering
The site actively encourages users to bookmark an alternative landing page (https://xn--2q1bp1r9rce9ecnf02r.org/) and follow a Telegram channel (t.me/redbdo) to receive domain-change notifications when the current domain is blocked by Korean authorities. This is a persistence mechanism designed to maintain access to a site operated in defiance of government blocking orders. (location: page.html lines 1333-1334, page-text.txt lines 1081-1085)
hidden content
A Cloudflare challenge script is injected via a hidden 1x1 invisible iframe (position:absolute, top:0, left:0, visibility:hidden) that dynamically creates and appends a script element inside the iframe's document. This pattern injects JavaScript into a hidden frame to bypass bot detection, and the inner script payload is delivered as an innerHTML string rather than a standard src attribute, which is an obfuscation pattern used to evade static analysis. (location: page.html line 2021, page-text.txt line 1662)
malicious redirect
Multiple sidebar and popup banner elements are initially rendered with the CSS class 'hidden' and only revealed client-side via JavaScript after checking cookies. These hidden-until-JS popups link to offshore gambling sites (spd-7575.com, daemul-10.com, dgg-0088.com, kkr-1777.com). This pattern hides affiliate gambling redirects from static crawlers and security scanners. (location: page.html lines 274-307, 1564-1694)
brand impersonation
The site repeatedly positions itself as a direct replacement ('대체 사이트') for '야동코리아', a well-known blocked Korean adult site, including in the page title, meta description, H1 heading, and SEO content sections. This co-opts the brand recognition and user trust associated with the original site to drive traffic to this domain. (location: page.html lines 24-25, 1220, 1250-1255, page-text.txt lines 970, 1000-1005)
obfuscated code
Several external advertisement and gambling site links use Punycode/IDN encoded domains (xn-- format) which encode non-ASCII characters. Examples include xn--v52bj1bo8a19n9ns.net, xn--2i0ba880pba.com, xn--hz2b29k79dink.net, xn--9w3b29jm1b12m.com, xn--2i0bj3zlqs.com, xn--tl3bz6j.com, xn--6w2bt3gw3cu1k.com, xn--2q1bp1r9rce9ecnf02r.org. These encode Korean-language domain names in a format that obscures the actual destination from users viewing source code or link previews. (location: page.html lines 758-819, 1071, 1122, 1137, 1152, 1333, 1426)
social engineering
The site advises users to use a VPN to minimize personal information exposure while accessing the site, and instructs users how to bypass access blocks by checking for the latest domain. This normalizes circumvention of legal content restrictions and shifts legal/security risk onto users. (location: page.html lines 1376-1384, page-text.txt lines 1126-1135)
curl https://api.brin.sh/domain/yadongtv86.comCommon questions teams ask before deciding whether to use this domain in agent workflows.
yadongtv86.com currently scores 37/100 with a suspicious verdict and low confidence. The goal is to protect agents from high-risk context before they act on it. Treat this as a decision signal: higher scores suggest lower observed risk, while lower scores mean you should add review or block this domain.
Use the score as a policy threshold: 80–100 is safe, 50–79 is caution, 20–49 is suspicious, and 0–19 is dangerous. Teams often auto-allow safe, require human review for caution/suspicious, and block dangerous.
brin evaluates four dimensions: identity (source trust), behavior (runtime patterns), content (malicious instructions), and graph (relationship risk). Analysis runs in tiers: static signals, deterministic pattern checks, then AI semantic analysis when needed.
Identity checks source trust, behavior checks unusual runtime patterns, content checks for malicious instructions, and graph checks risky relationships to other entities. Looking at sub-scores helps you understand why an entity passed or failed.
brin performs risk assessments on external context before it reaches an AI agent. It scores that context for threats like prompt injection, hijacking, credential harvesting, and supply chain attacks, so teams can decide whether to block, review, or proceed safely.
No. A safe verdict means no significant risk signals were detected in this scan. It is not a formal guarantee; assessments are automated and point-in-time, so combine scores with your own controls and periodic re-checks.
Re-check before high-impact actions such as installs, upgrades, connecting MCP servers, executing remote code, or granting secrets. Use the API in CI or runtime gates so decisions are based on the latest scan.
Learn more in threat detection docs, how scoring works, and the API overview.
Assessments are automated and may contain errors. Findings are risk indicators, not confirmed threats. This is a point-in-time assessment; security posture can change.
integrate brin in minutes — one GET request is all it takes. query the api, browse the registry, or download the full dataset.