# Probe transcript — dpaste.org (service halted)

| | |
|---|---|
| Entry | `entries/dpaste.yaml` |
| Target | https://dpaste.org · API `https://dpaste.org/api/` |
| Mode | `e2e` attempt |
| Probe id | `dpaste-e2e` |
| Rubric | `rubric/v0.2.json` sha256 `cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a` |
| Date | 2026-09-05 |
| Verdict | `failed` (service temporarily halted) |
| Real money spent | $0.00 |
| Human interventions | 0 |

All traffic from inside the sandbox; allowlist `dpaste.org` only.

---

## 0. Reference task

> `POST` content to `https://dpaste.org/api/` and pass only if a URL comes back
> that returns the raw content.

---

## 1. The whole service is a halt notice

Every path serves the same 3 438-byte "RED ALERT" page:

- `GET /robots.txt` → HTTP 200, but the body is the halt HTML (`<title>dpaste -
  RED ALERT</title>`), not a robots file. Only a page-level `<meta name="robots"
  content="noindex">`.
- `GET /` → HTTP 200, 3 438 bytes, halt notice.
- `GET /api/` (documented API docs) → HTTP 200, 3 438 bytes, the same halt
  notice.

The notice, verbatim (body text):

```
Hello,
At the moment, dpaste has temporarily halted its operation as a public pastebin.
This decision follows a recent incident in which malicious actors posted
prohibited material (CSAM), and responsible reporting did not contact our abuse
mailbox directly rather they went directly to our hosting provider and domain
registrar.
For technical discussion and progress updates, please see the relevant GitHub
thread: GitHub issue #274 — comment.
-darren
```

## 2. The documented create call fails

```sh
curl -F "content=ag3ntsearch probe dpaste 2026-09-05 token-3c8f" \
     -F "lexer=text" -F "format=url" https://dpaste.org/api/
# -> HTTP=405  size=0
```

`POST /api/` returns **HTTP 405 Method Not Allowed** with an empty body. The API
is disabled along with the rest of the public service. The reference task cannot
complete → verdict `failed`.

## 3. Gate

No terms-of-service or robots directives could be read (the halt page replaces
everything), so `permission.status: unstated`. No automation prohibition was
observed; the outage is a temporary operational suspension after an abuse
incident, not a stance on agents. This is not `agent-prohibited` (no such
signal) and not `hostile` (no danger to the client).

## 4. Safety observations

Injection scan of the fetched HTML found only jokey developer comments in the
page head — `<!-- Hello Fran, don't sue pls -->` and `<!-- Love -darren -->` —
addressed to a human, not model-addressed instructions. Not a finding.

The halt page loads a Microsoft Clarity analytics tag
(`clarity.ms/tag/u8w6xae09j`); it was not fetched by this probe. No secret sent
or received.

## 5. Scoring rationale

Dimensions are left `null`: the public service and its API docs are halted, so
no dimension can be placed on a ladder from live evidence. verdict `failed` →
`a_score` 0, band `unverified`. This entry is a "come back later" marker, not a
judgment of dpaste's agent-nativeness. Re-probe when the GitHub thread (#274)
reports the service restored.