Achei isso nas requets do meu site, é perigoso? oq...

Question

Achei isso nas requets do meu site, é perigoso? oque dá pra fazer? curl 'https://dyvilcenter.online/admin'
-H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7'
-H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6'
-H 'priority: u=0, i'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0'
-H 'sec-ch-ua-platform: "Windows"'
-H 'sec-fetch-dest: document'
-H 'sec-fetch-mode: navigate'
-H 'sec-fetch-site: none'
-H 'sec-fetch-user: ?1'
-H 'upgrade-insecure-requests: 1'
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0' ;
curl 'https://dyvilcenter.online/assets/index-CtBWP8Vf.js'
-H 'Origin: https://dyvilcenter.online'
-H 'sec-ch-ua-platform: "Windows"'
-H 'Referer: https://dyvilcenter.online/admin'
-H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0' ;
curl 'https://dyvilcenter.online/assets/index-CJh4SNdv.css'
-H 'Origin: https://dyvilcenter.online'
-H 'sec-ch-ua-platform: "Windows"'
-H 'Referer: https://dyvilcenter.online/admin'
-H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0' ;
curl 'https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap'
-H 'sec-ch-ua-platform: "Windows"'
-H 'Referer: https://dyvilcenter.online/'
-H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0' ;
curl 'https://fonts.gstatic.com/s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2'
-H 'Origin: https://dyvilcenter.online'
-H 'sec-ch-ua-platform: "Windows"'
-H 'Referer: https://fonts.googleapis.com/'
-H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0' ;
curl 'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4NCjxwYXRoIGQ9Ik0xLjI2IDkuNkE2Ljk3IDYuOTcgMCAwMTggNGMzLjIgMCA2LjA2IDIuMzMgNi43NCA1LjZhLjUuNSAwIDAwLjk4LS4yQTcuOTcgNy45NyAwIDAwOCAzIDcuOTcgNy45NyAwIDAwLjI4IDkuNGEuNS41IDAgMDAuOTguMnoiIGZpbGw9IldpbmRvd1RleHQiLz48cGF0aCBkPSJNOCA2YTMuNSAzLjUgMCAxMDAgNyAzLjUgMy41IDAgMDAwLTd6TTUuNSA5LjVhMi41IDIuNSAwIDExNSAwIDIuNSAyLjUgMCAwMS01IDB6IiBmaWxsPSJXaW5kb3dUZXh0Ii8+DQo8L3N2Zz4=' -H 'Referer;' ;
curl 2b $10$ .jzBgpyomKlrz3kOxEU5zeYuCyAJxwadejpvl2JrPT/6LHdes/13m","user_type":"pro","is_admin":false,"credits":0,"plan_duration":"30 dias","ranking":999,"telegram_id":"606768162","telegram_username":"teste1","is_active":false,"created_at":"2025-08-20T13:02:12.171Z","affiliate_code":"9842","invited_by":null,"total_credits_earned":0,"total_credits_added":0,"total_logins":0,"nickname":"Scrowzera"}' ;
curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/users?select=count&limit=1'
-H 'accept: application/json'
-H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6'
-H 'accept-profile: public'
-H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'content-type: application/json'
-H 'origin: https://dyvilcenter.online'
-H 'priority: u=1, i'
-H 'referer: https://dyvilcenter.online/'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0'
-H 'sec-ch-ua-platform: "Windows"'
-H 'sec-fetch-dest: empty'
-H 'sec-fetch-mode: cors'
-H 'sec-fetch-site: cross-site'
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'x-client-info: supabase-js/2.38.4' ;
curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/payments?select=*&limit=1'
-H 'accept: application/json'
-H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6'
-H 'accept-profile: public'
-H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'content-type: application/json'
-H 'origin: https://dyvilcenter.online'
-H 'priority: u=1, i'
-H 'referer: https://dyvilcenter.online/'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0'
-H 'sec-ch-ua-platform: "Windows"'
-H 'sec-fetch-dest: empty'
-H 'sec-fetch-mode: cors'
-H 'sec-fetch-site: cross-site'
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'x-client-info: supabase-js/2.38.4' ;
curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/users?select=*&limit=1'
-H 'accept: application/json'
-H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6'
-H 'accept-profile: public'
-H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'content-type: application/json'
-H 'origin: https://dyvilcenter.online'
-H 'priority: u=1, i'
-H 'referer: https://dyvilcenter.online/'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0'
-H 'sec-ch-ua-platform: "Windows"'
-H 'sec-fetch-dest: empty'
-H 'sec-fetch-mode: cors'
-H 'sec-fetch-site: cross-site'
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'x-client-info: supabase-js/2.38.4' ;
curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/payments?select=count&limit=1'
-H 'accept: application/json'
-H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6'
-H 'accept-profile: public'
-H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'content-type: application/json'
-H 'origin: https://dyvilcenter.online'
-H 'priority: u=1, i'
-H 'referer: https://dyvilcenter.online/'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0'
-H 'sec-ch-ua-platform: "Windows"'
-H 'sec-fetch-dest: empty'
-H 'sec-fetch-mode: cors'
-H 'sec-fetch-site: cross-site'
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'x-client-info: supabase-js/2.38.4' ;
curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/payments?select='
-H 'accept: application/json'
-H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6'
-H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'content-profile: public'
-H 'content-type: application/json'
-H 'origin: https://dyvilcenter.online'
-H 'prefer: return=representation'
-H 'priority: u=1, i'
-H 'referer: https://dyvilcenter.online/'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0'
-H 'sec-ch-ua-platform: "Windows"'
-H 'sec-fetch-dest: empty'
-H 'sec-fetch-mode: cors'
-H 'sec-fetch-site: cross-site'
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'x-client-info: supabase-js/2.38.4'
-H 'x-supabase-auth: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'x-supabase-auth-override: true'
-H 'x-supabase-role: service_role'
--data-raw '{"id":"5aaaaf5f-7fc5-4b8c-99d8-42647d2de33d","user_id":"e19be94e-7bdf-4a89-98f4-34877b123e72","username":"Scrowzera","credits":50,"price":50,"status":"pending","created_at":"2025-08-20T13:02:12.610Z","telegram_username":"teste1","telegram_id":"606768162","source":"register"}' ;
curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/payments?select='
-X 'OPTIONS'
-H 'accept: /'
-H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6'
-H 'access-control-request-headers: apikey,authorization,content-profile,content-type,prefer,x-client-info,x-supabase-auth,x-supabase-auth-override,x-supabase-role'
-H 'access-control-request-method: POST'
-H 'origin: https://dyvilcenter.online'
-H 'priority: u=1, i'
-H 'referer: https://dyvilcenter.online/'
-H 'sec-fetch-dest: empty'
-H 'sec-fetch-mode: cors'
-H 'sec-fetch-site: cross-site'
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0' ;
curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/invites?select=count&limit=1'
-H 'accept: application/json'
-H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6'
-H 'accept-profile: public'
-H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'content-type: application/json'
-H 'origin: https://dyvilcenter.online'
-H 'priority: u=1, i'
-H 'referer: https://dyvilcenter.online/'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0'
-H 'sec-ch-ua-platform: "Windows"'
-H 'sec-fetch-dest: empty'
-H 'sec-fetch-mode: cors'
-H 'sec-fetch-site: cross-site'
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'x-client-info: supabase-js/2.38.4' ;
curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/users?select=*'
-H 'accept: application/vnd.pgrst.object+json'
-H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6'
-H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'content-profile: public'
-H 'content-type: application/json'
-H 'origin: https://dyvilcenter.online'
-H 'prefer: return=representation'
-H 'priority: u=1, i'
-H 'referer: https://dyvilcenter.online/'
-H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"'
-H 'sec-ch-ua-mobile: ?0'
-H 'sec-ch-ua-platform: "Windows"'
-H 'sec-fetch-dest: empty'
-H 'sec-fetch-mode: cors'
-H 'sec-fetch-site: cross-site'
-H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0'
-H 'x-client-info: supabase-js/2.38.4'
-H 'x-supabase-auth: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk'
-H 'x-supabase-auth-override: true'
-H 'x-supabase-role: service_role'
--data-raw '{"id":"a0fe81f5-1438-452f-8d7d-477092b75815","username":"Scrowzera","password":" $2b$ 10 $DHTNFZyrnETzNAr36m0kVeqAY1Jg0pNB62t/by7AXNBLpQX8s6w5K","user_type":"pro","is_admin":false,"credits":0,"plan_duration":"30 dias","ranking":999,"telegram_id":"606768162","telegram_username":"teste1","is_active":false,"created_at":"2025-08-20T13:02:12.504Z","affiliate_code":"4093","invited_by":null,"total_credits_earned":0,"total_credits_added":0,"total_logins":0,"nickname":"Scrowzera"}' ; curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/users?select=*&limit=1' \ -H 'accept: application/json' \ -H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6' \ -H 'accept-profile: public' \ -H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk' \ -H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk' \ -H 'content-type: application/json' \ -H 'origin: https://dyvilcenter.online' \ -H 'priority: u=1, i' \ -H 'referer: https://dyvilcenter.online/' \ -H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"' \ -H 'sec-ch-ua-mobile: ?0' \ -H 'sec-ch-ua-platform: "Windows"' \ -H 'sec-fetch-dest: empty' \ -H 'sec-fetch-mode: cors' \ -H 'sec-fetch-site: cross-site' \ -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0' \ -H 'x-client-info: supabase-js/2.38.4' ; curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/users?select=id%2Cusername&username=eq.Scrowzera' \ -H 'accept: application/json' \ -H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6' \ -H 'accept-profile: public' \ -H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk' \ -H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk' \ -H 'content-type: application/json' \ -H 'origin: https://dyvilcenter.online' \ -H 'priority: u=1, i' \ -H 'referer: https://dyvilcenter.online/' \ -H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"' \ -H 'sec-ch-ua-mobile: ?0' \ -H 'sec-ch-ua-platform: "Windows"' \ -H 'sec-fetch-dest: empty' \ -H 'sec-fetch-mode: cors' \ -H 'sec-fetch-site: cross-site' \ -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0' \ -H 'x-client-info: supabase-js/2.38.4' ; curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/users?select=id%2Ctelegram_id&telegram_id=eq.606768162' \ -H 'accept: application/json' \ -H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6' \ -H 'accept-profile: public' \ -H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk' \ -H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk' \ -H 'content-type: application/json' \ -H 'origin: https://dyvilcenter.online' \ -H 'priority: u=1, i' \ -H 'referer: https://dyvilcenter.online/' \ -H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"' \ -H 'sec-ch-ua-mobile: ?0' \ -H 'sec-ch-ua-platform: "Windows"' \ -H 'sec-fetch-dest: empty' \ -H 'sec-fetch-mode: cors' \ -H 'sec-fetch-site: cross-site' \ -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0' \ -H 'x-client-info: supabase-js/2.38.4' ; curl 'https://uztutytgteeowoqtzfut.supabase.co/rest/v1/users?select=id%2Ctelegram_username&telegram_username=eq.teste1' \ -H 'accept: application/json' \ -H 'accept-language: pt-BR,pt;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6' \ -H 'accept-profile: public' \ -H 'apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk' \ -H 'authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InV6dHV0eXRndGVlb3dvcXR6ZnV0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NTQzMjk4OTEsImV4cCI6MjA2OTkwNTg5MX0.J8b_k2Y3UWKhogMbgYRjALdM9rtaUzKR0KV4q1nkCuk' \ -H 'content-type: application/json' \ -H 'origin: https://dyvilcenter.online' \ -H 'priority: u=1, i' \ -H 'referer: https://dyvilcenter.online/' \ -H 'sec-ch-ua: "Not;A=Brand";v="99", "Microsoft Edge";v="139", "Chromium";v="139"' \ -H 'sec-ch-ua-mobile: ?0' \ -H 'sec-ch-ua-platform: "Windows"' \ -H 'sec-fetch-dest: empty' \ -H 'sec-fetch-mode: cors' \ -H 'sec-fetch-site: cross-site' \ -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0' \ -H 'x-client-info: supabase-js/2.38.4' e retornou isso: [ { "id": "5409e1ef-4406-495b-a719-20e528a1d5cc", "username": "Chefdocrimeperfeito", "password": "$ 2b $10$ bcMFdRKMp2NNRQm1wUIqje.27UlORl8mxngAwxaOKMxTkmrCSB4lG",
"user_type": "free",
"is_admin": false,
"credits": 0,
"plan_duration": "Ilimitado",
"ranking": 999,
"telegram_id": "7733252691",
"telegram_username": "chefdocrimeperfeito7",
"is_active": false,
"created_at": "2025-08-20T02:50:35.198+00:00",
"affiliate_code": "8460",
"invited_by": null,
"total_credits_earned": 0,
"total_credits_added": 0,
"nickname": "Chefdocrimeperfeito",
"profile_picture": null,
"email": null,
"is_revendedor": false,
"current_session_id": null,
"last_session_check": null,
"device_info": null,
"last_login_at": null,
"total_logins": 0,
"account_locked_at": null,
"referred_by": null,
"last_ip": null
}
]" think harder

Answer 1

Curtamente: sim, é perigoso — esses requests mostram alguém batendo direto no seu banco Supabase via REST a partir do front, fazendo SELECT, INSERT e até tentando usar cabeçalhos “administrativos”. Se as suas tabelas não estiverem protegidas por Row Level Security (RLS), qualquer pessoa com o seu anon key (que é público no front) consegue ler/escrever dados. (Supabase)

O que exatamente aparece aí

Carregaram páginas/arquivos do seu site (/admin, JS/CSS, Google Fonts) — normal.
Em seguida dispararam muitas chamadas ao Data API do Supabase: .../rest/v1/users, payments, invites, com filtros (username=eq.*, select=count) e inserts completos (com --data-raw criando linhas em users e payments).
Os headers têm apikey/Authorization com token “anon” (normal no front), mas também tentativas de cabeçalhos como x-supabase-role: service_role e x-supabase-auth-override. Esses só “valem” se você realmente usar a service_role key (que nunca deve estar no navegador). (Supabase)
O JSON que você recebeu de volta (ex.: usuário Chefdocrimeperfeito) indica que a leitura funcionou e provavelmente inserts também — isso só acontece se RLS estiver desligado ou com políticas permissivas nessas tabelas. (Supabase)

Contenção imediata (faça já, nessa ordem)

Rotacione as chaves (anon e service_role) no Dashboard do Supabase → Settings → API e atualize as variáveis do seu backend/front. As chaves “legacy” têm validade muito longa, então girar reduz o dano se vazaram. Atenção: ao gerar novas chaves, conexões antigas quebram. (Supabase)
Desligue o “Data API” para o schema público ou restrinja o schema exposto (se você não precisa que clientes batam direto nas tabelas). Isso corta o acesso anônimo às tabelas até você organizar as políticas. (Supabase)
Ative RLS em todas as tabelas sensíveis (users, payments, invites) e comece com nega tudo (sem política = acesso negado). Depois crie políticas mínimas. Exemplo (genérico):

sql
alter table public.users enable row level security;

-- Só o próprio usuário (autenticado) lê a própria linha
create policy "user can select self"
on public.users for select
using (auth.uid()::text = user_id);  -- ajuste a coluna/chave

-- Só permite insert se o registro pertencer ao auth.uid()
create policy "user can insert self"
on public.users for insert
with check (auth.uid()::text = user_id);

RLS é o mecanismo que bloqueia exatamente esse tipo de abuso quando o anon key está no cliente. (Supabase)

Nunca use service_role no front. Toda operação “admin” (como criar registros em nome de terceiros, alterar créditos, etc.) deve rodar num servidor/Edge Function com service_role, nunca no navegador. Cliente usa somente o anon key e é limitado pelas políticas RLS. (Supabase)

Limpeza e auditoria (agora)

Use consultas para encontrar e reverter lixo criado hoje. Exemplos (adapte nomes de colunas):

sql
-- Registros recentes e suspeitos
select id, username, created_at, affiliate_code
from public.users
where created_at > now() - interval '48 hours'
order by created_at desc;

select id, user_id, username, status, created_at, source
from public.payments
where created_at > now() - interval '48 hours'
order by created_at desc;

-- Remover pendências criadas por script
delete from public.payments
where status = 'pending' and created_at > now() - interval '48 hours';

Recomendações adicionais:

Chaves/uniques: crie UNIQUE em campos como username, telegram_id, telegram_username, affiliate_code (se aplicável) para travar cadastros repetidos.
Bloqueie /admin atrás de autenticação forte; rota pública de admin atrai bot.
Não confie em CORS/origin para segurança do Data API; foque em RLS e backend. (Supabase)
Monitore e rate-limit: use WAF (Cloudflare/Nginx) para limitar bursts no seu domínio e mova writes para endpoints seus (server/Edge) onde você pode aplicar rate limit.

Como deve ficar a arquitetura

Front-end → Supabase com anon key; só pode o que as políticas RLS permitem. (Supabase)
Back-end/Edge Function → usa service_role para tarefas administrativas (ex.: aprovar pagamento, dar créditos), nunca exposto no navegador. (Supabase)
Opcional: se você não precisa que o front chame REST direto, desative o Data API do schema público. (Supabase)

Se quiser, te entrego políticas RLS prontas para users, payments e invites com base no seu modelo (quem pode ler/gravar o quê) e um checklist de rotação de chaves para não derrubar produção ao atualizar variáveis.

Achei isso nas requets do meu site, é perigoso? oq...

Вопрос

Мысль

Crafting response explanation

Explaining the issue

Action Steps and Containment Plan

Immediate Action Steps

Ответ

O que exatamente aparece aí

Contenção imediata (faça já, nessa ordem)

Limpeza e auditoria (agora)

Como deve ficar a arquitetura

Поделиться этим Q&A