> ## Documentation Index
> Fetch the complete documentation index at: https://api.docs.flare.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Paste

The `paste` event type corresponds to public text pastes found on paste sites such as *Pastebin*, *JustPaste.it*, *YamCode*, or similar sharing services.\
These entries typically contain raw text dumps, links to leaked data, code snippets, or communication content,  sometimes referencing or re-hosting credential leaks.

```json Example Content theme={null}
{
  "activity": {
    "data": {
      "es_id": "paste_site/example_paste_12345",
      "es_score": 1.0,
      "highlights": {},
      "id": "example_paste_12345",
      "index": "paste",
      "metadata": {
        "estimated_created_at": "2025-03-18T00:00:00Z",
        "event_id": null,
        "first_crawled_at": "2025-03-18T09:00:00Z",
        "last_crawled_at": "2025-03-18T09:00:00Z",
        "payload_digest": "123abc456def789ghi012jkl345mno678pqr901",
        "scraped_at": "2025-03-18T09:00:30Z",
        "source": "paste_site",
        "crawled_by": null,
        "flare_url": "https://app.cti.example.com/#/paste/paste_site/example_paste_12345"
      },
      "uid": "paste/paste_site/example_paste_12345",
      "url": "http://pasteexample.onion/example_paste_12345",
      "browser_url": null,
      "actor": "threat_user01",
      "actor_id": null,
      "actor_name": "threat_user01",
      "content": "Example text containing links or credentials shared on a paste site.",
      "content_en": null,
      "title": "Leaked Credentials Paste",
      "title_en": null,
      "expire_at": null,
      "syntax": null,
      "features": {
        "domains": ["example.com"],
        "emails": null,
        "ip_addresses": null,
        "ip_addresses_cidr": null,
        "reversed_domains": ["com.example"],
        "urls": ["example.com/leak123"],
        "usernames": null,
        "vulnerabilities": null
      }
    },
    "duplicates": [],
    "header": {
      "actor": "threat_user01",
      "actor_id": null,
      "bank": null,
      "bin": null,
      "brand": null,
      "credential_count": null,
      "category_name": "",
      "content_hash": "123abc456def789ghi012jkl345mno678pqr901",
      "content_preview": "Example text containing links or credentials...",
      "country": null,
      "duplicates": [],
      "es_score": 1.0,
      "expiration": null,
      "highlights": {},
      "host": null,
      "id": "example_paste_12345",
      "infection_date": null,
      "parent_id": null,
      "parent_title": null,
      "parent_title_en": null,
      "parent_uid": null,
      "parent_uids": [],
      "risk": {
        "score": 2
      },
      "similar_items_count": 0,
      "source": "paste_site",
      "source_name": "Paste Site",
      "target_name": "Paste Site",
      "tags": [],
      "notes": null,
      "state_code": null,
      "timestamp": "2025-03-18T00:00:00Z",
      "title": "Leaked Credentials Paste",
      "type": "paste",
      "uid": "paste/paste_site/example_paste_12345",
      "user_risk_score": null,
      "user_notes": null,
      "ignored_at": null,
      "remediated_at": null,
      "verb": "",
      "external_url": null,
      "external_netloc": null,
      "can_have_duplicates": true,
      "priority_action_uuid_related": false,
      "analyzers_items_uids": [],
      "victim_name": null,
      "contains_secrets": false,
      "secrets_metadata": []
    },
    "history_logs": null,
    "metadata": {
      "estimated_created_at": "2025-03-18T00:00:00Z",
      "event_id": null,
      "first_crawled_at": "2025-03-18T09:00:00Z",
      "last_crawled_at": "2025-03-18T09:00:00Z",
      "payload_digest": "123abc456def789ghi012jkl345mno678pqr901",
      "scraped_at": "2025-03-18T09:00:30Z",
      "source": "paste_site",
      "crawled_by": null,
      "flare_url": "https://app.cti.example.com/#/paste/paste_site/example_paste_12345"
    },
    "similar_items": []
  }
}
```