🏜️ Mirage

Brand Impersonation & Scam Detector — find the fake domains, fake numbers and fake pages that pretend to be you.

Fill in your organization's official data once (domains, branch phone numbers, WhatsApp, emails, social accounts — or import them from Excel). Mirage then hunts for anything that looks like you but isn't: typosquatted domains, freshly issued SSL certificates carrying your brand, phishing pages, unofficial "call center" numbers in ads, fake social accounts, and content injected into your own website — then helps you validate, report and track takedown. 100% free & open-source components. No API keys. No telemetry. One Windows app, click and run.

⬇️ Install · ✨ Features · 📖 How to Use · 🎛️ Menu guide · ⚠️ Disclaimer

---

🧩 The Problem

Scammers don't hack your company — they pretend to be it. A one-letter-off domain (noxnulll.com), a subdomain on a look-alike (promo.noxnul.com), a Google/Facebook ad or search snippet that shows your real address with their WhatsApp number, a "tarif baru" page asking for PIN & OTP, an undangan.apk download. Each one is cheap to create and costly to find by hand.

Mirage turns that hunt into one repeatable scan with a ranked list of findings, a plain-language reason for every score point, evidence snapshots, and a ready-to-send takedown report.

✨ Key Features

Module	What it finds	Source (free)
🔤 Look-alike domains	typo, omission, homoglyph (1↔l, Cyrillic а), IDN/punycode, TLD swap (.id, .com, .xyz…), combosquatting (brand-cs, promo-brand), subdomain abuse (brand.co.id.verify-akun.xyz)	dnstwist + own generator, DNS (A/AAAA/MX/NS)
📜 Certificate Transparency	brand-new domains that just got an SSL certificate containing your brand — usually before the phishing page is indexed	crt.sh
🏛️ Official-site integrity	phone numbers/WhatsApp not in your official list appearing on your own website, online-gambling SEO spam (slot gacor), APK links — i.e. defacement & injection	crawler
🔎 Search engine	search results/snippets that mention your brand with unofficial numbers	self-hosted SearXNG
⚡ Quick check	paste an ad text, SMS, WhatsApp message or search snippet — or a list of URLs — get a verdict instantly	offline / direct fetch

Page analysis (for every live suspicious page): brand claim, official vs unofficial phones (including wa.me/…, api.whatsapp.com, tel: buttons, range notation (031)5550095-99, obfuscation like O812-…), password/PIN/OTP forms, forms posting to another domain or Telegram bot, APK downloads, free-mail "official" addresses, fake social accounts, hot-linked official assets, identical favicon (Shodan-compatible mmh3 hash) & title, parked-domain detection.

Findings by category — one phishing page is split into separate, trackable findings:

Category	Sub-types	Report to
🌐 Domain / 🔗 Subdomain	active-phishing · active · parked · registered · APK/download	registrar / hosting abuse
🎣 Phishing page	login/PIN/OTP form · APK download · scam content	hosting, Google Safe Browsing
📞 Phone / WhatsApp	WhatsApp · mobile · landline · short number	aduannomor.id (Komdigi), IASC OJK, WhatsApp, operator
👤 Social media	Instagram · Facebook · X · TikTok · YouTube · Telegram · LinkedIn · Threads	platform impersonation form
🏛️ Compromised official site	injected number/content · gambling SEO spam	your web team
📝 Text / ad / search result	manual text · search snippet	—

A number or account is tracked across sources ("seen on 4 sites / ads"), so repeat offenders rise to the top. Anti-false-positive rules: numbers are only flagged when the page/text claims your brand, official numbers (including ranges) and whitelisted third parties are skipped, landlines need stronger evidence than WhatsApp/mobile, and a source you marked False positive no longer spawns number/account findings.

Page analysis (every live suspicious page): brand claim, official vs unofficial phones (wa.me/…, api.whatsapp.com, tel: buttons, range notation (031)5550095-99, obfuscation like O812-…), password/PIN/OTP forms, forms posting to another domain or a Telegram bot, APK downloads, free-mail "official" addresses, fake social accounts, hot-linked official assets, identical favicon (Shodan-compatible mmh3 hash) & title, parked-domain detection.

• 🗂️ Findings by category — one phishing page becomes separate, trackable findings: 🌐 Domain · 🔗 Subdomain · 🎣 Phishing page · 📞 Phone/WhatsApp · 👤 Social media · 🏛️ Compromised official site · 📝 Text/ad. Numbers and accounts are tracked across sources ("seen on 4 sites"), so repeat offenders rise to the top.
• 🎯 Low false positives by design — numbers are flagged only when the page/text claims your brand; official numbers (incl. ranges) and whitelisted third parties (regulators, partners) are skipped; landlines need stronger evidence than WhatsApp/mobile; a source marked False positive stops spawning findings.
• ✅ Validation workflow — dedicated tab with work queues To validate · Needs re-review · Verified · Reported · Taken down · False positive · Closed. Confirm scam adds the value to your known-scam list; False positive adds it to the official/allowed list — the detector learns from every decision. Reporting channel + ticket number, one-click re-check, full audit trail.
• 🔁 Periodic or fresh scans — continue (merge into saved data; new/changed items flagged; a taken-down site that comes back is re-queued automatically) or fresh scan (old findings archived, never deleted).
• 📊 Excel import/export — template with one sheet per data type and example rows; paste 500+ branch numbers at once. Example rows are skipped automatically, and example data is never mixed with your real profile.
• 📤 PDF & HTML reports — start with your official reference data (legitimate vs known-scam) so reviewers can compare at a glance, then a summary per category & status, then one section per category with category-specific columns, verification steps and the right reporting channels (registrar/hosting, Google Safe Browsing, aduannomor.id, IASC OJK, platform impersonation forms). Also CSV & JSON.
• 🥇 Risk score 0–100 with a human-readable reason for every point (HIGH / MEDIUM / LOW / INFO).
• 🧾 Evidence — gzip HTML snapshot + headers, redirect chain, server IP, SHA-256.
• 🔔 Notifications only for new or escalated findings — Telegram, webhook (Slack/Discord/Teams/SOAR), SMTP.
• 🧲 Auto-fill from your official website — suggests phones, WhatsApp, emails, social accounts, favicon & title for review.
• 🖥️ GUI + CLI — Mirage.exe for analysts, mirage-cli.exe for Task Scheduler / SOAR (exit code 2 = new HIGH finding).
• 🛡️ Safe by design — JavaScript never executed, binaries never downloaded, normal browser User-Agent, optional HTTP/SOCKS proxy so your office IP isn't exposed.
• 🌐 Generic — nothing hard-coded: any company, financial institution, e-commerce, agency or university can use it. Ships with a clearly marked fictional example (PT. Noxnull Indonesia). UI: Bahasa Indonesia, with a built-in user guide (F1).

🖼️ Screenshots

Findings — category chips, per-finding reasons, sources and verification steps.

Validation — work queues, confirm / false positive, report & takedown tracking.

Profile — your official data (or import it from Excel); the example profile is clearly marked.

PDF report — official reference data first, then findings per category.

💻 System Requirements

	Minimum
OS	Windows 10 or 11, 64-bit (Qt 6 dropped Windows 7/8)
RAM	2 GB
Disk	~250 MB free (app + evidence snapshots)
Network	Internet (DNS, crt.sh, RDAP, target pages); optional proxy supported
Optional	Search module: WSL 2 + Docker Desktop (installed automatically by the Mirage installer) or Rancher Desktop; +4 GB RAM recommended

Cross-platform note: the code also runs on Linux/macOS from source (python main.py), but official binaries are Windows-only for now.

⬇️ Installation

For users (recommended)

1. Go to Releases.
2. Installer — download MirageSetup-<version>.exe, run it (per-user, no admin rights needed), get a Start Menu shortcut and an uninstaller. (Recommended for most people.)
3. Portable — download Mirage-Portable-<version>.zip, extract, run Mirage.exe. Data stays next to the exe (the zip contains portable.txt).
4. Search engine (optional) — the installer can set up Docker Desktop + SearXNG for you (see Free search engine). After that it is one click (⚡ Hidupkan) or fully automatic when Mirage opens.

First launch may show Windows SmartScreen because the build isn't code-signed. Click More info → Run anyway. Verify integrity with the published .sha256.txt checksum next to each download.

For developers (run from source)

git clone https://github.com/n0xnull/Mirage.git
cd Mirage
python -m venv .venv && .venv\Scripts\activate     # Windows
pip install -r requirements.txt
python main.py            # GUI
python cli.py --help      # CLI

Build the .exe yourself

:: Windows, one click (picks Python 3.12/3.11, builds in its own .venv-build):
build.bat
:: -> dist\Mirage\Mirage.exe + dist\Mirage\mirage-cli.exe (portable folder, --onedir)

Manual equivalent:

pip install -r requirements-dev.txt
pytest tests/ -q
pyinstaller mirage.spec --noconfirm --clean

Python 3.10.0 is rejected — its dis module crashes PyInstaller with IndexError: tuple index out of range. Use 3.11 or 3.12.

Build the installer yourself

:: Requires Inno Setup 6 (https://jrsoftware.org/isdl.php) and build.bat done first:
build-installer.bat
:: -> dist\MirageSetup-<version>.exe

Pushing a version tag (git tag v1.2.0 && git push origin v1.2.0) triggers .github/workflows/build.yml — GitHub Actions runs the unit tests on Windows and Linux (a failing test blocks the release), builds on a Windows runner, smoke-tests the CLI, and publishes the portable ZIP and the installer with SHA-256 checksums to a GitHub Release automatically.

📖 How to Use

1. ① Profil — on first start Mirage only contains a clearly marked 🧪 example profile (fictional PT. Noxnull Indonesia / noxnull.com). Your data is never pre-filled: Unduh template Excel → fill → Impor Excel → profil baru (or create an empty profile). Minimum: brand keywords, official domain, official phone/WhatsApp. Then click Isi otomatis dari situs resmi and review the suggestions.
2. ② Pemindaian — pick modules (daily: look-alike domains + Certificate Transparency + official-site integrity) and choose continue or fresh scan.
3. ③ Cek Cepat — paste a suspicious ad / SMS / WhatsApp text or URLs for an instant verdict.
4. ④ Temuan — browse by category, read reasons, sources and verification steps; Ekspor PDF / HTML.
5. ⑤ Validasi — work the queues: Benar penipuan / Salah deteksi → copy the report template → Tandai dilaporkan (channel + ticket) → Cek ulang → Sudah take-down.
6. ⑥ Pengaturan — analyst name (audit trail), proxy, DNS, SearXNG, notifications.

Example: the ad snippet

Noxnull — Office Network
Head Office, Jl. Merdeka 1, Jakarta, (021)5550100-05, Hubungi CS WA 0852-1234-5678

→ HIGH: brand claimed, (021)5550100–5550105 recognized as official (range expanded), +62 852-1234-5678 split into its own Phone/WhatsApp finding — an unofficial mobile number presented as "CS WA" next to official ones.

What Each Menu Does (beginner hints)

Menu / tab	What it does
① Profil	Your official data. Excel template/import/export, auto-fill from your website, profile management (new, rename, duplicate, delete).
② Pemindaian	Run the modules; choose continue (merge) or fresh scan (archive old findings).
③ Cek Cepat	Check pasted text or a list of URLs without a full scan.
④ Temuan	All findings by category/level/status; archives; export PDF/HTML/CSV/JSON.
⑤ Validasi	Decide, report and track takedown; locked until the profile is saved.
⑥ Pengaturan	Analyst name, proxy, DNS servers, SearXNG kit, notifications.
Bantuan ▸ Panduan (F1)	Full user guide in Bahasa Indonesia, with filled-in examples.
Bantuan ▸ Disclaimer / Lisensi / Tentang	Terms of use, third-party licenses, credits.

Command line (optional)

mirage-cli profile init --out profil_saya.json          # create a profile template
mirage-cli profile fingerprint -p profil_saya.json      # store favicon hash + title
mirage-cli scan -p profil_saya.json -m lookalike,ct,official --report laporan.pdf -v
mirage-cli scan -p profil_saya.json --fresh --report laporan.html   # archive old findings first
mirage-cli check-url  -p profil_saya.json https://suspicious.example/login
mirage-cli check-text -p profil_saya.json --file iklan.txt
mirage-cli findings   -p profil_saya.json --level HIGH --export tinggi.pdf
mirage-cli profile autofill -p profil_saya.json       # suggestions from your official site
mirage-cli findings   -p profil_saya.json --abuse 12     # print takedown template for finding #12
mirage-cli findings   -p profil_saya.json --category phone --queue todo
mirage-cli validate 12 confirm  -p profil_saya.json --add-to-profile      # → known scam list
mirage-cli validate 15 fp       -p profil_saya.json --add-to-profile allowed_numbers
mirage-cli validate 12 reported -p profil_saya.json --note "aduannomor ADN-123" --actor Abil
mirage-cli profile excel-template --out template_profil.xlsx
mirage-cli profile import-excel -p profil_saya.json --file template_profil.xlsx [--replace]
mirage-cli profile export-excel -p profil_saya.json --out profil.xlsx

Exit codes: 0 no new HIGH finding · 2 new HIGH finding · 1 error.

🗓️ Daily Scheduled Scan

Windows Task Scheduler (runs every day at 06:00):

schtasks /Create /TN "Mirage Daily Scan" /SC DAILY /ST 06:00 ^
  /TR "\"C:\Users\<you>\AppData\Local\Programs\Mirage\mirage-cli.exe\" scan -p profil_saya.json -m lookalike,ct,official --report %APPDATA%\Mirage\reports\harian.html"

Enable Telegram/webhook/email in Pengaturan — only new or escalated findings are sent, so the daily run doesn't spam the SOC. Secrets can come from environment variables instead of settings.json: MIRAGE_TELEGRAM_TOKEN, MIRAGE_TELEGRAM_CHAT, MIRAGE_WEBHOOK_URL, MIRAGE_SMTP_PASSWORD.

🔎 Free search engine: SearXNG

Google's Custom Search JSON API is closed to new customers and is being discontinued on 1 January 2027, and Brave's Search API moved to metered billing (no free plan). Mirage therefore uses SearXNG, an open-source metasearch engine you run yourself:

Automatic, one click (Windows). Keep "Pasang mesin pencari otomatis (Docker Desktop + SearXNG)" ticked in the installer. Mirage then checks WSL 2 (enables it with one UAC prompt + one restart if missing), downloads the official Docker Desktop installer and installs it per-user (install --user --quiet --accept-license --backend=wsl-2), prepares SearXNG (JSON enabled, random secret key, bound to 127.0.0.1:8888 only), starts it and tests the connection. After a restart it resumes by itself.

Afterwards, starting the engine is a single click — the ⚡ Hidupkan button in the status bar, the Mirage - Hidupkan Mesin Pencari desktop/Start-menu shortcut, or automatically when Mirage opens (default). Mirage starts Docker Desktop, starts the mirage-searxng container and verifies a JSON query. If a scan includes the search module while the engine is off, Mirage offers Hidupkan & lanjutkan. Docker Desktop is set to start at Windows sign-in, so after the first success the engine is usually already running. If anything fails, installation still continues; Pengaturan → Cek & diagnosa shows a checklist (WSL 2, Docker installed/running, internet to Docker Hub, SearXNG, connection test) and ↻ Coba lagi repeats the setup — broken containers are recreated automatically and ghcr.io is used when Docker Hub is blocked. Technical log: %APPDATA%\Mirage\logs\engine.log. CLI: mirage-cli engine install | start | stop | status.

Licensing: Docker Desktop is free for personal use, education and small businesses; organizations with ≥ 250 employees or ≥ US$10 M annual revenue need a paid Docker subscription. Free alternative: Rancher Desktop (dockerd/moby mode) — Mirage uses any working docker command automatically.

Manual:

docker run -d --name mirage-searxng -p 127.0.0.1:8888:8080 -v ./config:/etc/searxng searxng/searxng
# ./config/settings.yml:
#   use_default_settings: true
#   server: { secret_key: "<random>", limiter: false }
#   search: { formats: [html, json] }
docker restart mirage-searxng

Public instances usually disable the JSON API, and they would see your brand-protection queries — run your own. Upstream engines may rate-limit heavy use — keep the query list short and scan once a day.

⚙️ How it Works

profile (official domains, numbers, accounts — typed in or imported from Excel)
  → look-alike candidates (dnstwist + own generator)  ─┐
  → Certificate Transparency (crt.sh)                   ├→ DNS / RDAP / HTTP fetch (no JS)
  → official-site crawl · SearXNG search · quick check ─┘
  → page & text analysis (brand claim, phones, forms, APK, social, favicon/title)
  → entity split (domain · subdomain · page · phone · social · official · text)
  → risk score 0–100 with reasons → SQLite (dedup, cross-source merge, re-review triggers)
  → validation (decisions update the profile) → reports (PDF / HTML / CSV / JSON) & notifications

Every module runs in isolation — one failing source (e.g. crt.sh timing out) is reported and never stops the others. Nothing is ever sent anywhere except the lookups themselves and the notifications you configure.

📁 Data location

Mode	Where
Installed	%APPDATA%\Mirage\
Portable (portable.txt next to the exe)	<exe folder>\data\
Override	environment variable MIRAGE_HOME

Contains profiles\, mirage.db (SQLite findings), evidence\, reports\, logs\crash.log, settings.json.

🚧 Limitations (be honest with your SOC)

• JavaScript is not executed. Kits that render content purely with JS, or that cloak by IP/geo, may look empty. Verify HIGH/MEDIUM findings manually in an isolated browser/VM, ideally over the configured proxy.
• Paid ads cannot be pulled automatically for free. Google has no public Ads Transparency API, and Meta's Ad Library API only returns political/social-issue ads outside the EU/UK. Paste the ad text/URL into Cek Cepat instead.
• Social-media & WhatsApp content is not crawled (ToS/login). Links to them from web pages are analyzed.
• crt.sh is a free community service and is sometimes slow/unavailable — the module retries and reports the error without stopping other modules.
• Heuristic scores are triage aids, not verdicts. Keep the ignore list and owned-domain list up to date to reduce false positives.

🗺️ Roadmap

• v1.3 — optional headless-browser screenshot (Playwright) + perceptual logo match.
• v1.4 — CertStream real-time feed (self-hosted certstream-server-go), urlscan.io / VirusTotal enrichment (optional free keys).
• v2.0 — STIX/MISP export & SIEM integration, multi-analyst shared database.

🤝 Contributing

Issues and PRs welcome. Run pytest tests/ -q before submitting — the release workflow refuses to build if any test fails. Please never commit real organization profiles, findings databases, or evidence files.

🛠️ Third-Party Components

Mirage uses only free & open-source libraries (PySide6, dnstwist, dnspython, tldextract, phonenumbers, requests, BeautifulSoup, python-whois, mmh3, ReportLab, Pillow, openpyxl) and free public services (crt.sh, RDAP). See THIRD-PARTY-LICENSES.md for every license.

⚠️ Disclaimer

A defensive tool: use it only to protect an organization you are authorized to represent. Mirage performs passive checks only (DNS, RDAP/WHOIS, CT logs, unauthenticated GET requests — no JavaScript, no login, no exploitation). All findings are heuristics and must be verified by a human before any report or takedown request. See DISCLAIMER.md.

📄 License

MIT © 2026 Abil Khosim. Third-party libraries and services remain the property of their respective owners.

---

👤 Developed by Abil Khosim

Cybersecurity Specialist

Mirage is an original project by Abil Khosim, an independent security tool by Abil Khosim (NoxNull). Released under the MIT License — © 2026 Abil Khosim. Please keep this attribution when reusing or redistributing.

_{Not everything that looks like you is you. 🏜️}