A full-featured tracking awareness demonstration platform that shows users how websites silently collect:
- Behavioral signals (clicks, scroll depth, time spent)
- Cross-domain tracking using tracking pixels
- Fingerprint IDs (via FingerprintJS)
- Location details (Country, State, City)
- Interest profiling from visited pages
- Pixel tracking endpoint (
/track.gif) that receives data from any domain. - Blog-style landing page with thumbnails and auto-generated interest categories.
- Cross-domain mini site that sends tracking pixels to your main server.
- Admin dashboard with real-time charts & live event feed.
- Visitor profiling (interests, device, browser, location, engagement score).
- Country + State + City detection via ip-api.com.
app.py β Main Flask tracking + blog + admin system cross_domain_site.py β Optional second-site that loads tracker JS static/cross_tracker.js β Cross-domain pixel tracker script profiles.json β Auto-generated visitor database README.html β This file
The homepage shows a real blog layout with:
- Thumbnail images
- Blog category tags
- Short excerpt
- Clickable blog URLs like:
/blog/tech/top-5-tech-trends-2025
When a visitor opens a blog page, the category (Tech, Cybersecurity, News, Stock, Instagram) is added to their interest profile automatically.
The system uses a bulletproof tracking pixel:
No CORS, no OPTIONS, no sendBeacon issues β works on:
- Android Chrome
- Firefox
- Safari iOS
- All cross-domain environments
The admin panel includes:
- Total visitors
- Total visits
- Page-view graph
- Interest chart
- Cross-domain site chart
- Live tracking feed (WebSocket real-time)
Shows full analytics per profile:
- Country, State, City, IP
- Device, OS, Browser
- Engagement graph
- Visit timeline
- Interest categories
Your second site simply loads:
<script src="http://YOUR-IP:5000/static/cross_tracker.js"></script>
This automatically sends:
- Clicks
- Scroll depth
- Time spent
- Fingerprint ID
- Current page URL
pip install flask flask-cors flask-socketio requests
python app.py
python cross_domain_site.py
Visit: /admin/login
Default password:
admin123
You SHOULD change it inside app.py.
- User opens your blog β Tracker JS loads silently
- Every few seconds + on page exit β sends pixel request
- Server decodes engagement + device + location + interests
- Admin panel displays analytics in real-time
You may add:
- Homepage screenshot
- Admin dashboard screenshot
- Visitor detail page screenshot
Available Our Hacking Course
This project is for educational & cyber-awareness purposes only.
Created by Nitish (Linuxndroid) for cybersecurity education and awareness.
