v1.31.1 - Honest wording

A small wording release. There are no changes to scanning.

pip install --upgrade deadrecon

Changed

• Scan reports show stealth in place of stealth-guaranteed. The word overpromised. The value in JSON exports is unchanged.
• Softer claims. The README and PyPI page no longer promise "exactly what you leaked" or say no other open-source tool reports on you.
• Logo credit. The logo was inspired by The Sun by littlebitspace, now credited on the About page and README.

See the changelog for details.

v1.31.0 - A quieter console and a new look

The console no longer contacts other servers by default, and DeadRecon has a new look. Upgrade if you use the web console.

pip install --upgrade deadrecon

Security

• The console keeps to itself. Opening it used to tell Google Fonts and cdnjs, and on map pages unpkg, that you were using the tool. Fonts, socket.io and Leaflet now ship with the package, and the content security policy no longer allows those hosts. A map tile server you configure is still contacted.

New look

• Black, signal red and yellow, with condensed poster headlines, across the console and HTML reports.
• A new logo: card XIII, a skull with a red censor bar across its eyes.
• The Light theme and its switch are gone.

Fixed

• HTML and Markdown exports no longer crash on a scan with no risk score, threat level or duration, such as one that was aborted or failed.
• Maps stay dark when no basemap is set, which is the default.
• PDF reports print cleanly, without the misaligned title band and black table.

See the changelog for details.

v1.30.0 - PhantomSignal is now DeadRecon

PhantomSignal is now DeadRecon. It's the same tool with a new name, and nothing you've saved is lost. Scans also no longer name the tool to targets or third parties.

pip uninstall phantomsignal
pip install deadrecon

Important

Docker users: run docker-compose down before you pull, or the old container keeps port 5000. Your data volumes keep their names, so your data stays.

What moves on first run

• ~/.phantomsignal moves to ~/.deadrecon, with a link left at the old path.
• A default phantomsignal.db moves to deadrecon.db.
• Your API keys, scans and account come with them. You'll need to log in again once, but API tokens keep working.

What still works

PHANTOMSIGNAL_* variables, config/phantomsignal.yaml, and encrypted exports made by earlier versions. The phantomsignal and psig commands also still work alongside deadrecon and the new short drecon.

Breaking

JSON exports use deadrecon_version in place of phantomsignal_version, and exported files start with deadrecon_. Update anything that parses these.

Security

• Scans no longer name the tool. Targets and third-party services used to receive EHLO phantomsignal.local, MAIL FROM:<probe@phantomsignal.local> and PhantomSignal-OSINT User-Agents. They now get a neutral SMTP name and a browser User-Agent. Packet captures across all 23 modules found no mentions of the name. Saved reports still name the tool, since only you see them.
• nmap's version scan no longer sends its Nmap Scripting Engine User-Agent. Its other probes are still recognizable, so an nmap scan is still reported as attributable.

See the changelog for details.

v1.29.3 - Protection from hostile targets and safer secrets

Security fixes for scans of hostile targets, and Telegram tokens stay out of results and logs. Upgrade if you scan targets you don't control or have used a Telegram key.

pip install --upgrade phantomsignal

Important

Results saved by earlier versions can still hold your Telegram bot token. If you've used a Telegram key, check saved scans, exports and logs, and rotate the token if it appears.

Security

• Telegram bot tokens stay out of results, logs and error values. photo_url is replaced by photo_file_id, so Telegram avatars no longer appear in people results.
• JS mining handles hostile pages. A crafted page could stall a scan for minutes. Parsing now takes linear time, and a malformed script address no longer ends the module.
• Public pages can't send JS mining or favicon fetches to private addresses on direct scans.
• JS mining and favicon downloads stop at 3 MB, with or without TLS impersonation.
• The network guard recognizes IPv4 addresses inside IPv6 ones, including IPv4-compatible, 6to4 and NAT64 forms.
• Console errors no longer repeat raw exception text. Export API failures that aren't the caller's fault now return HTTP 500 rather than 400, and an unknown scan returns 404.

Fixed

• GitHub now recognizes the MIT license. The terms haven't changed. The usage disclaimer moved to the README's Legal & Ethics section.

See the changelog for details.

v1.29.2 — Console port scans, CLI fixes and corrected docs

Port scans started from the web console now work. Upgrade if you use the console.

pip install --upgrade phantomsignal

Important

Console scans that include port_scan now send real probes to the target directly from your IP. Before this release they found no open ports, so a console scan showing none wasn't a clean result, and you may want to rerun it. The report marks the module as attributable, and Tor and Covert scans still skip it.

Fixed

• Console port scans. The form sent a profile name like common where the scanner expected a list of ports. The Common, Top 1000 and Full range options now take effect, and port_scan_fast handles them too.
• --modules rejects unknown names. The documented --modules dns,port,tech ran nothing and still reported a completed scan. Unknown names are now an error, and you can separate names with commas or repeat the flag.
• --format xlsx works on the CLI, for both scan and export.
• phantomsignal init points at Integrations for API keys.
• The console's profile cards say what profiles do. They promised modules, port ranges and durations that profiles don't control.

Documentation

• The usage guide lists every command and scan flag, with correct defaults.
• Scan profiles are described as they work: Deep currently runs the same modules and ports as Standard.
• Troubleshooting has the correct database path, log location and Docker volume name.

Testing

Checked with packet captures of scans using the form's options, including the Tor toggle and Covert profile. The Full range option wasn't run, and neither was real Tor with those options.

Full details: changelog

v1.29.1 — Updated docs, corrected claims and a Tor grade note

A small follow-up to v1.29.0, which has the upgrade steps. Scanning and grading behave the same.

pip install --upgrade phantomsignal

Corrections

Earlier docs overstated a few things:

• Not every network source uses the stealth layer. Keyed API providers and some keyless sources connect directly unless Tor is on. The scan report already marked the intel module as attributable, but the site and README said otherwise. If you use a proxy without Tor, don't assume those lookups are hidden.
• The source count is 50+, not 54+.
• "Provably Masked" is gone from the site, because a normal scan with a port scan grades Exposed.

Changed

• Tor scans explain a Partial grade. The scan report and CLI say when every counted request went through Tor and the grade is Partial only because of TLS fingerprinting. The CLI also confirms the scan was on Tor.

Fixed

• The CLI's API key hint pointed at a command that doesn't exist. It now points at phantomsignal status.
• The PyPI page, README and site now cover 1.29, and the quick starts mention the first-run setup token.

Full details: changelog

v1.29.0 — One-click Tor, honest OPSEC grades & security hardening

Tor now works from one click, and OPSEC grades are checked against real traffic.

pip install --upgrade phantomsignal

Important

If you used Tor before this release, those scans were not on Tor. The old setting and the --profile covert container never routed scan traffic, so those scans connected directly from your IP.

Highlights

One-click Tor

• The 🧅 button starts Tor with nothing to configure. It uses a Tor already running, or the installed program, or downloads the official bundle checked against a pinned hash. Tor is also built into the Docker image.
• Tor fails closed: each scan confirms it's on Tor before touching the target and stops if it can't. Modules that would bypass Tor are skipped and listed in the report.
• All HTTP and DNS use Tor, targets get separate circuits, and .onion addresses are never sent to a resolver.

Honest OPSEC grades

• All module HTTP is counted, DNS goes through the proxy, and a module that sends a direct request is reported as attributable.
• No scan can read as masked or quiet without a proxy, and masked now requires stealth-level modules only.
• nuclei is reported as attributable even with a proxy, because some of its traffic still connects directly. Don't rely on a proxy to hide nuclei scans.

Security hardening

• Blocks SSRF to metadata and internal addresses, and DNS rebinding on direct HTTP.
• Adds a nonce-based Content-Security-Policy, escapes scan data in links and popups, and validates scan targets.
• Parses XML from scanned targets with defusedxml.
• The Docker image runs as non-root under gunicorn, with dependencies pinned by hash. CI actions are pinned to commit SHAs.

Fixes

• Brotli responses can be read without TLS impersonation.
• The web crawler, tls_fingerprint and Origin Pivot findings work again.
• External tool failures are reported, and timed-out tools are killed.

Upgrading

Docker needs a one-time step, because the container no longer runs as root:

docker compose run --rm --user root phantomsignal chown -R app:app /app/data /app/exports /home/app/.phantomsignal

PHANTOMSIGNAL_HOST and PHANTOMSIGNAL_PORT no longer apply in Docker; change the published port in docker-compose.yml.

Some scans now do less, on purpose:

• Tor scans skip port_scan, port_scan_fast, service_enum, tls_fingerprint and vuln_scan.
• Covert scans skip modules that connect directly.
• Proxied scans: nuclei runs HTTP templates only, subfinder skips crt.sh, and zone transfers and raw TLS and JARM probes are skipped.
• Maps have no background until you set geo.tile_url.

curl_cffi 0.17 or newer is now required, and brotli is a new dependency.

Coming from 1.27.0

1.28.0 was tagged but never published to PyPI, so PyPI users get its breaking changes here too:

• The web console requires a login. The first run prints a setup token to the server log. phantomsignal set-password and phantomsignal api-token are new CLI commands.
• REST API calls need Authorization: Bearer <token>, and GET /api/v1/health returns only status unless signed in.
• Docker Compose publishes on loopback only. See "Signing in" in docs/USAGE.md for reverse-proxy setup.
• Exports moved to ~/.phantomsignal/exports. Set PHANTOMSIGNAL_EXPORT_DIR to override.

Known limits

• The Windows and Intel Mac Tor bundles have pinned hashes but haven't been run.
• Automatic Tor start doesn't configure bridges, so networks that block Tor need a self-run Tor service.
• Public free proxies weren't tested.

Full details: 1.29.0 changelog · Compare with v1.27.0

v1.27.0 — OPSEC core, best-of-breed engines & keyless identity intelligence

The OPSEC-native era, tagged. First release since v1.24.0 — it bundles the v1.25 stealth/attribution core, the v1.26 best-of-breed engines + vuln loop, and the new v1.27 identity-intelligence + egress-UX layer.

Highlights

🛰 OPSEC core

• Per-scan attribution surface report — % proxied vs. direct, JA3/JA4 profiles worn, WAF challenges, per-module posture.
• Shared StealthClient under every module (proxy pool + adaptive pacing + sticky identity + optional JA3/JA4 impersonation); --opsec {off,quiet,paranoid} CLI flag.
• Egress-posture chip in the navbar (STEALTH / PARTIAL / DIRECT).

🎯 Best-of-breed engines + vuln loop

• vuln_scan wraps nuclei → vulnerability findings + STIX 2.1 Vulnerability SDO (opt-in).
• Adapters for subfinder / naabu / katana / tlsx, proxy-injected, with pure-Python fallback.

👤 Identity intelligence (new in 1.27.0)

• 8 keyless Profiler sources: XposedOrNot, GitHub commit-email harvester, GitLab, Wikidata, WebFinger, offline phone intel (libphonenumber), openFEC, OpenCorporates.
• Profiler runs are now scans — persisted as people_intel scans with history, summary, and export, plus a View in Scans shortcut.
• Keyless sources routed through the stealth layer so they inherit the proxy pool and land in the attribution ledger.

🔌 Egress management

• Proxy-pool seeding — curated free feeds, custom URL, or file upload.
• Settings persistence — stealth profile + proxy pool survive a restart (env-loaded API keys are never written to disk).

Fixes

• Profiler results page crash when a social profile was found.
• Dark-mode native <option> dropdown theming.

Notes

• New dependency: phonenumbers (offline; degrades gracefully if absent).
• 298 tests passing. Full detail in the CHANGELOG.

🤖 Generated with Claude Code

v1.24.0 — Two themes, Dark refresh & docs cleanup

[1.24.0] — 2026-07-12

Simplified the web console to two themes and removed the pre-rendered demo /
screenshot assets in favour of richer written descriptions.

Changed

• Themes cut to two: the opt-in Neon theme was removed; the console now
  ships Dark (default) and Light only. The :root[data-theme="neon"]
  token block, the third nav toggle, and the now-dead cycleTheme() helper were
  deleted. Legacy --neon-* colour-utility aliases are unaffected — they resolve
  to the active theme's role tokens.
• README banner: replaced the ASCII-art logo block with the project name and
  tagline.
• README + landing page: the "Demo" / "Live Demo" sections no longer embed a
  screenshot GIF or asciinema recording. They now show a plain-text terminal
  transcript plus a written breakdown of each scan stage, and the functional
  copy was expanded throughout.
• De-cyberpunk pass: removed "cyberpunk" / "Phantom Dawn" flavour wording from
  the README, USAGE.md, web/app.py, and the About page, and dropped the
  landing page's animated matrix-rain canvas and CRT scanline overlay (elements,
  CSS, and JS).
• "Ghost Mode" → Covert / Evasive: brought the public docs in line with the
  app's plain-language terminology. The README feature, landing-page callout, and
  USAGE.md now describe the Covert scan profile and Evasive (low & slow)
  toggle instead of "Ghost Mode"; corrected the CLI reference (--profile covert,
  not ghost; dropped the non-existent --ghost flag). The Docker Tor sidecar
  compose profile was renamed ghost → covert (docker-compose --profile covert).
• USAGE.md nav-terminology sync: brought the full user guide in line with the
  app's current plain-language UI — "Ghost Run(s)" → Scans, "New Mission" →
  New Scan, "Ghost Keys" → Integrations, "Quick Probe" → Quick Scan /
  the Quick profile, "Shadow Grid" → Dashboard, "Shadow Profiler" →
  Profiler, "Shadow Score" → Risk Score, profile names Standard/Deep, and
  the "Start Scan" button — including the nav map, section headings, and TOC anchors.
• GitHub Pages retheme: the landing site (docs/index.html, docs/site.css)
  was recoloured from the coral/neon marketing palette to the app's default Dark
  theme — deep-slate surfaces, federal-blue hero, steel-blue links, gold accents,
  restrained glow, and an app-aligned green → amber → red risk-score ramp. README
  and landing-page shield badges were updated to the same blue / steel / gold.

Removed

• docs/assets/demo.gif, docs/assets/demo.cast, docs/assets/screenshot_cli.svg,
  and the scripts/gen_assets.py generator (its only outputs were the removed
  demo / screenshot assets).
• The asciinema embed and "play it locally" instructions from the README.
• The figlet ASCII-art blocks from the landing page — the hero banner and the
  "Ready to run a scan?" CTA banner — leaving the styled PHANTOMSIGNAL wordmark
  and headings (hero recentred to a single column).
• All sponsorship / funding solicitation: the GitHub Sponsors badge and
  "Sponsors" tier section in the README, the landing page's nav / footer sponsor
  links and sponsor-tier section (plus its CSS), and .github/FUNDING.yml.

---

v1.21.0 — Operations-console theme system + WCAG AA accessibility pass

A ground-up redesign of the web UI's theming onto a USWDS-style semantic token model, with a full accessibility pass to W3C / WCAG 2.1 AA. The default look moves off neon-green-on-black to a restrained slate operations console with an indigo→cyan accent — while the original neon look is preserved as an opt-in cyberpunk theme.

Design system

• Role tokens (--surface-*, --ink-*, --accent*, --success/--warning/--danger/--info) are the single source of truth; components consume roles, never raw hues. Tints use rgba(var(--role-rgb), a) so one component rule recolours across every theme. Legacy --neon-* names are kept as aliases.
• Severity semantics: colour is reserved for status (green = success, amber = warning, red = danger, indigo/cyan = interactive) instead of decoration.

Themes

• dark (operations console, default), light, and cyberpunk (legacy neon, intact).
• A nav control cycles System → Light → Dark → Cyberpunk. System carries no data-theme and follows prefers-color-scheme live.

Accessibility (W3C / WCAG 2.1–2.2)

• Every text/UI token verified to meet AA contrast (≥4.5:1 text, ≥3:1 control borders) — fixes the previously-failing muted-text and border tokens.
• color-scheme property + <meta name="color-scheme"> so native controls/scrollbars/inputs match the active scheme.
• A single high-contrast :focus-visible keyboard indicator (2.4.7 / 2.4.13).
• prefers-reduced-motion block disabling the matrix rain, scanlines, glitch layers, and transitions (2.2.2 / 2.3.3); retro effects are now cyberpunk-only.

Verified visually via Playwright across all three themes on the dashboard, scan form, and settings pages. No Python surface changed; 147 tests pass.