lbeauvisage / phantom-analyzer

Phantom Analyzer scans websites for spy pixels. It runs via Laravel Vapor using Browsershot. Built by the https://usefathom.com team.

Phantom Analyzer

Phantom Analyzer was a tool we launched during Halloween 2020. It's a much simpler version of Blacklight by The Markup and we had so much fun running it for a year. We've decided to retire it, and open-source the code to let people either host it themselves, or simply learn how to run Browsershot on Laravel Vapor. This tool is perfect for companies who might want a quick way to audit vendors or companies they're working with.

Screenshots

Requirements

The following requirements are how we ran Phantom Analyzer.

• PHP 7.4
• Laravel Vapor
• AWS account

You absolutely can run it outside of Vapor, but we haven't tested that, so it's on you :)

Instructions

1. Create a new project in Laravel Vapor
2. Put your Vapor Project ID into the vapor.yml file
3. (optional) Add a custom domain to your vapor.yml file
4. Run vapor deploy production or vapor deploy staging
5. In Vapor, run phantom:cache_spy_pixels to populate DynamoDB (default cache driver) with the spy pixel list
6. Celebrate 🍾

Updating the spy pixel list

You can add/remove values from the spy pixel list any time you want. We seldom do this, so we hard-coded things, but you can do it.

1. Update resources/trackers.txt
2. Open app/Jobs/ScanWebsite.php and increase the VERSION constant (e.g. 0.2 becomes 0.3)
3. Deploy to Vapor
4. Run phantom:cache_spy_pixels in the Vapor environment to populate the new values

FAQ

Question: What is Laravel Vapor?

Answer: If you've never used Laravel Vapor before, but you're curious, take the Serverless Laravel course and master Laravel Vapor.

Question: Who built Phantom Analyzer?

Answer: We did. Fathom Analytics is a privacy-first analytics solution founded by Jack Ellis and Paul Jarvis.

Question: I have an issue, where can I get help?

Answer: The reason we disabled issues on here is because we just don't have the capacity to offer support on this project. We'd recommend asking on Laracasts, Stack Overflow or in the Serverless Laravel slack group.

Question: Why are spy pixels bad?

Answer: Fathom cofounder, Paul Jarvis, has written more here.

Disclaimer

• We offer no kind of liability on this software, or any guarantees. This software is provided as-is and we accept zero legal responsibility for any issues. We ran this in production for a year, and had no problems.
• We've performed an audit on the codebase, and added credit where it's due, but we cannot guarantee that we've caught everything. For example, we may have used code from StackOverflow or GitHub gists to solve a problem. We've added credit where we can find the source but if we haven't credited you, please contact us and we'll get you added.
• We will not be maintaining this, keeping it up to date or anything else. This is for reference purposes only and provided as-is.

License

Phantom Analyzer is open-sourced software licensed under the MIT license. However, where we've used code from other sources (such as Stack Overflow or GitHub gists), you'll need to check the license.