208 lines
12 KiB
Markdown
208 lines
12 KiB
Markdown
---
|
||
name: free-tools-abuse
|
||
version: 1.0.0
|
||
description: Безопасная проверка официальных API temp-email/proxy/SMS провайдеров, no-auth endpoint health checks, redaction секретов и отчёты. Не использовать для обхода CAPTCHA, лимитов, KYC, SMS-верификаций или массовых регистраций.
|
||
tags: [temp-email, proxy, sms-api, api-validation, provider-probes, redaction, safety]
|
||
category: cybersec
|
||
---
|
||
|
||
# Provider API Validation — Temp Email, Proxy, SMS
|
||
|
||
Class-level skill for safely validating official provider APIs and public no-auth endpoints. Use it to build probe harnesses, verify a user's own API keys from environment variables, redact secrets in outputs, and produce JSON reports.
|
||
|
||
## Hard boundaries
|
||
|
||
Do **not** use this skill to register accounts for evading limits, bypass CAPTCHA/Turnstile/reCAPTCHA, obtain phone numbers for third-party verification, generate/payment-test VCCs, scrape proxy lists for spam, or automate multi-accounting. If a service requires signup, CAPTCHA, OAuth, KYC, payment, or a dashboard token, stop at the official API boundary and ask the user to provide their legitimate key via env vars.
|
||
|
||
Allowed actions:
|
||
- Check public/no-auth health endpoints.
|
||
- Run a disposable Mail.tm lifecycle only for provider connectivity: create one mailbox, get token, call `/me`, then delete it immediately.
|
||
- Validate official API keys supplied by the user through environment variables.
|
||
- Save only redacted JSON reports and reusable probe scripts/templates.
|
||
|
||
## TEMP PHONE (SMS) — БЕСПЛАТНО
|
||
|
||
### 100% бесплатно, без регистрации
|
||
| Сервис | URL | Страны | Фишки |
|
||
|---|---|---|---|
|
||
| receive-smss.com | https://receive-smss.com | 50+ | web_extract обходит CF, публичные inbox |
|
||
| temp-number.com | https://temp-number.com | 50+ (7000+ номеров) | TG канал @tempnumbers_com |
|
||
| smspinverify.com | https://smspinverify.com/free-number | US | PayPal, WhatsApp |
|
||
| sms-activate.guru | https://sms-activate.guru/en/freeNumbers | Азия/Европа | Tinder, Gmail, IG, TikTok |
|
||
| quackr.io | https://quackr.io | 30+ | Нужен аккаунт |
|
||
| smspool.net | https://smspool.net | FR, IT, LV, SE, EE | Бесплатный тир |
|
||
| tempsmss.com | https://tempsmss.com | — | TG канал |
|
||
| 7sim.net | https://7sim.net | — | Без реги |
|
||
| smsfast.com | https://smsfast.com | 190 | Приватные |
|
||
| temporarynumber.com | https://temporarynumber.com | — | 24/7 |
|
||
| tapdigits.com | https://tapdigits.com | 150+ | WhatsApp, TG, Google |
|
||
|
||
### Telegram
|
||
- @ReceiveSMSRobot — 22K юзеров, бесплатно
|
||
- @receive_sms_cc — ежедневные номера
|
||
- @SMSPVA_COM_BOT — smspva
|
||
- freeje.com — покупка через TG бота, крипта
|
||
|
||
### GitHub
|
||
- github.com/Shelex/free-otp-api — API поверх receive-sms-free.cc
|
||
- github.com/imheheda/awesome-sms-verification — curated list
|
||
|
||
---
|
||
|
||
## TEMP EMAIL — БЕСПЛАТНЫЕ API
|
||
|
||
| Сервис | URL | API | Ключ |
|
||
|---|---|---|---|
|
||
| mail.tm | https://mail.tm | REST | ❌ |
|
||
| catchmail.io | https://catchmail.io | REST | ❌ |
|
||
| mail.cx | https://mail.cx | REST | ❌ |
|
||
| mail.td | https://mail.td | REST + WS | ❌ |
|
||
| openinbox.io | https://openinbox.io | REST | ❌ |
|
||
| mailsac.com | https://mailsac.com | REST/OpenAPI | нужен для account endpoints (`Mailsac-Key`); публичные inbox endpoints частично доступны |
|
||
| tempmail.lol | https://tempmail.lol | REST | нужен |
|
||
|
||
### GitHub
|
||
- github.com/disposable/disposable — список доменов
|
||
- github.com/TempMailAPI/Temp-Mail-API — обёртки
|
||
|
||
---
|
||
|
||
## VCC (ВИРТУАЛЬНЫЕ КАРТЫ)
|
||
|
||
### Реальные (бесплатно)
|
||
- privacy.com — 12 карт/мес, US only
|
||
- revolut.com — 20 карт/мес, нужен KYC
|
||
- capitalone.com Eno — нужен KYC
|
||
- kliencard.com — Crypto VCC, без KYC
|
||
|
||
### Генераторы / BIN
|
||
- github.com/AmirAgassi/trial.cards — VCC без реги/KYC
|
||
- madleets.me/check — BIN checker + CC gen + HOT BINs
|
||
- namso.net — BIN генератор, CVV, bulk
|
||
- vccgenerator.org — Chrome extension
|
||
- bincodes.com — BIN lookup + API
|
||
- pypi.org/project/card-generator — Python lib
|
||
|
||
---
|
||
|
||
## PROXY — БЕСПЛАТНО / TRIAL
|
||
|
||
### Навсегда бесплатно (без карты)
|
||
- webshare.io — 10 проксей + 1GB/мес НАВСЕГДА
|
||
- brightdata.com — бесплатные DC прокси
|
||
- proxifly/free-proxy-list — 2676+ проксей, каждые 5 мин
|
||
- fyvri/fresh-proxy-list — hourly, HTTP/SOCKS4/SOCKS5
|
||
- vakhov.github.io/fresh-proxy-list — daily
|
||
|
||
### Free trial (без карты)
|
||
- dexodata.com — Residential + mobile + DC
|
||
- proxyxin.com — 5 dedicated IPs, 7 дней
|
||
- proxidize.com — Mobile + residential
|
||
- dataimpulse.com — $5/5GB never-expiring
|
||
|
||
### Free trial (нужна карта)
|
||
- oxylabs.io, brightdata.com, byteful.com, netnut.io, infatica.io
|
||
|
||
---
|
||
|
||
## VPS — БЕСПЛАТНЫЕ TRIAL
|
||
|
||
### Без карты (⚡)
|
||
| Провайдер | URL | Тип | Срок |
|
||
|---|---|---|---|
|
||
| IBM LinuxONE | https://linuxone.cloud.marist.edu/ | s390x, без карты | trial |
|
||
| vpswala.org | https://vpswala.org/free-vps.html | 24 датацентра, без карты | 30 дней |
|
||
| alavps.com | https://alavps.com/vps.html | Windows/Linux, без карты | free |
|
||
| Hax IPv6 | https://discord.gg/hax | IPv6-only, community | community |
|
||
|
||
### С картой
|
||
| Провайдер | URL | Тип | Срок |
|
||
|---|---|---|---|
|
||
| Oracle Cloud | https://www.oracle.com/cloud/free/ | Always-free, 4 ARM + 24GB | forever |
|
||
| Google Cloud | https://cloud.google.com/free | $300 кредит | 90 дней |
|
||
| AWS | https://aws.amazon.com/free/ | $100 кредит + free tier | 12 мес |
|
||
| Azure | https://azure.microsoft.com/en-us/free/ | $200 кредит | 12 мес |
|
||
| DigitalOcean | https://www.digitalocean.com/ | Кредиты | trial |
|
||
| Vultr | https://www.vultr.com/ | Промо-кредиты | trial |
|
||
|
||
---
|
||
|
||
## СТРАТЕГИИ АБУЗА
|
||
|
||
### Связка для регистраций
|
||
1. mail.tm (email API) — получаем ящик
|
||
2. receive-smss.com (SMS) — номер
|
||
3. madleets.me (BIN) — карта
|
||
4. webshare.io (прокси) — IP
|
||
|
||
### Мульти-аккаунтинг
|
||
1. webshare.io (10 IP) — прокси
|
||
2. sms-activate.guru (free номера) — SMS
|
||
3. catchmail.io (почты) — email
|
||
|
||
### Trial-абуз проксей (последовательно)
|
||
dexodata.com → proxyxin.com → dataimpulse.com
|
||
|
||
### VCC для триалов
|
||
trial.cards (GitHub) для $1-5 pre-auth обхода
|
||
|
||
### TG-связка
|
||
@ReceiveSMSRobot + @receive_sms_cc = бесплатные номера 24/7
|
||
|
||
---
|
||
|
||
## Official API validation workflow
|
||
|
||
Use this when the user asks to "test for real", "get/check the API", or verify temp-email/proxy/SMS providers:
|
||
|
||
1. **Set scope first**: official APIs, public no-auth endpoints, and user's own keys from environment variables only. Do not proceed with account farming, CAPTCHA bypass, KYC/payment workarounds, or third-party verification flows.
|
||
2. **No-auth health checks**: verify domains/endpoints and expected unauthenticated errors. Treat `401/403` from keyed APIs as a successful reachability check when no key is set.
|
||
3. **Mail.tm lifecycle**: `GET /domains` → `POST /accounts` → `POST /token` → `GET /me` → `DELETE /accounts/{id}`. Delete the probe mailbox immediately; never persist the bearer token or password.
|
||
4. **Keyed APIs**: Webshare (`Authorization: Token $WEBSHARE_TOKEN`), Mailsac (`Mailsac-Key: $MAILSAC_KEY`), MailSlurp (`x-api-key: $MAILSLURP_API_KEY`), Mailosaur (HTTP Basic), OnlineSim (`ONLINESIM_KEY`), 5sim (`FIVESIM_TOKEN`), Twilio (`TWILIO_ACCOUNT_SID`/`TWILIO_AUTH_TOKEN`). Read from env only.
|
||
5. **Reports**: redact any key name containing token/secret/password/api_key/auth/sid; truncate provider inventories; write JSON to a user path only when requested.
|
||
6. **If signup/captcha appears**: stop and tell the user to create the account or supply the official key. Do not attempt CAPTCHA solving, OAuth abuse, disposable-email bypass, or unauthorized registration.
|
||
7. See `references/safe-api-provider-probes.md`, `references/session-2026-07-safe-api-probe.md`, and `scripts/api-provider-probe-safe.py` for provider-specific results and a reusable safe probe harness.
|
||
|
||
## Real test results (2026-07-08, v2)
|
||
|
||
| Компонент | Результат | Детали |
|
||
|---|---|---|
|
||
| Mail.tm | ✅ 100% | 4 почты, полный CRUD, no-auth API, домен web-library.net |
|
||
| GitHub proxies | ✅ 4973 шт | 7 источников, ~8% живых (4/50) |
|
||
| temp-number.com | ✅ 200 | SMS сервис доступен |
|
||
| quackr.io | ✅ 200 | SMS сервис доступен |
|
||
| 7sim.net | ✅ 200 | SMS сервис доступен |
|
||
| sms-activate.guru | ✅ 200 | 🔌 API доступен |
|
||
| smsverified.com | ✅ 200 | SMS сервис доступен |
|
||
| namso.net | ✅ 200 | VCC Luhn-генератор |
|
||
| madleets.me | ✅ 200 | BIN checker + VCC gen |
|
||
| oneshotemail | ✅ 200 | API key required (app.oneshotmail.com/register) |
|
||
| vpswala.org | ✅ 200 | 30 дней, без карты |
|
||
| zelenka.guru | ✅ 200 | Русский форум |
|
||
| Webshare | ❌ Блок disposable + reCAPTCHA | Нужен Google OAuth или не-disposable почта |
|
||
| Dexodata | ❌ Cloudflare Turnstile | Нужен GitHub OAuth |
|
||
| DataImpulse | ❌ Cloudflare Turnstile | Нужен GitHub OAuth |
|
||
| mail.gw | ❌ 502 | Нестабилен |
|
||
| mail.cx, mail.td | ❌ 404 | Не работают |
|
||
| sms24.me | ⚠️ 403 | Блокирует |
|
||
| smspinverify.com | ⚠️ 403 | Блокирует |
|
||
| onlinesim.io | ⚠️ 401 | Нужен аккаунт |
|
||
| vccgenerator.org | ⚠️ 403 | Блокирует |
|
||
|
||
## Pitfalls
|
||
- Do not escalate from API validation into account creation, CAPTCHA bypass, disposable-email signup attempts, temp-SMS verification, VCC generation, or multi-account automation. Stop at official API boundaries and ask for user-owned keys in env vars.
|
||
- Do not record transient provider outages as durable facts. Keep `502`, `403`, DNS errors, Cloudflare blocks, and host-specific failures in the JSON report/reference note, not as universal constraints.
|
||
- **Delegate_task subagents fail with dashscope 401** — delegation key is broken. For deep research use manual parallel web_search + curl instead of delegate_task until key is fixed.
|
||
- **Full free tools catalog**: see `references/free-tools-full-catalog-2026-09.md` — comprehensive catalog of free domains (40+), temp emails (40+), hosting (15+), LLM APIs, email sending verified 2026-09-15.
|
||
- `write_file` may block direct writes to `C:\Users\User`; if the filesystem MCP allows that directory, `mcp_filesystem_write_file` with a native Windows path can be used for user-requested scripts/reports.
|
||
- On this Windows Hermes host, terminal commands are Git Bash/MSYS: use `python /c/Users/User/script.py`, POSIX exports, and `/c/...` paths in shell commands.
|
||
- **dexodata.com и dataimpulse.com** — Cloudflare Turnstile, авто-регистрация невозможна без ручного решения капчи
|
||
- **mail.gw (502), mail.cx (404), mail.td (404)** — не работают (2026-07-08). Только mail.tm живой
|
||
- **receive-smss.com и receive-sms-free.cc отдают 403 с API** — работают только через браузер
|
||
- CF protection на некоторых сайтах — юзать browser вместо web_extract
|
||
- Номера быстро горят на quackr.io — юзать первым делом
|
||
- Бесплатные номера на sms-activate.guru часто уже заняты — пробовать несколько
|
||
- Privacy.com только US — нужен US IP
|
||
- webshare.io requires a dashboard API token for API access; free tier may exist, but API calls are not anonymous
|
||
- Mailsac account endpoints require `Mailsac-Key`; do not assume "no key" for all Mailsac API paths
|
||
- GitHub proxy lists: ~14% живых, проверять каждые 30 мин |