PedroHBessa/backscan

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1691 stars · 444 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Node.js web application that serves a fake 'Comprovante' (payment receipt) page and exfiltrates the visitor's geolocation to an attacker-controlled Telegram bot via a /send-location endpoint. It is designed to be exposed to the internet through Ngrok and is functionally a phishing/social-engineering tool.

Use cases

• track a device's location by luring the target to open a link
• send captured geolocation data to a Telegram chat via a bot
• host a deceptive page locally and expose it with Ngrok
• demonstrate how phishing-based location harvesting works
• run a social-engineering awareness demo

When to choose

• you are a security educator demonstrating location-harvesting phishing techniques
• you want a minimal working example of Telegram bot exfiltration with Node.js
• you need a red-team style proof of concept for awareness training

When to avoid

• you want to track someone without their informed consent - this is illegal in most jurisdictions
• you need a legitimate, consent-based location sharing solution
• you need a production-grade or maintained project - it has no license, minimal code, and manual token editing in source files

Facets

application · maturity experimental

http-server web-scraping security security web-development privacy phishing telegram-bot location-tracking ngrok social-engineering credential-harvesting nodejs linux web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="PedroHBessa/backscan")