Electric Eye by gbiondo@reveng3.org

Electric Eye detects Adversary-in-the-Middle attacks in real time,
before your credentials are stolen.

Traditional MFA is defeated by real-time proxy kits like Evilginx and
Starkiller. The attack is invisible — the browser shows a valid
certificate, the site looks legitimate, the login succeeds. Your session
token is already gone.

Electric Eye analyses TLS fingerprints, HTTP headers, and DOM content
to detect proxy anomalies. Detection runs locally in WebAssembly — no
data leaves your browser.

Signals detected:
- Domain mismatch between URL and page content
- Certificate age anomalies
- Stripped security headers (CSP, HSTS)
- Proxy header signatures
- Protocol downgrade