🎭
16-mimic arsenal + personas
One node listens behind SSH, TLS/HTTPS, mail (SMTP/IMAP/SMTPS/IMAPS), databases (PostgreSQL/MySQL) and hosting/devops panels (cPanel, WHM, Webmail, DirectAdmin, Docker Registry, Grafana, Prometheus) — assembled into coherent server personas, with a per-install shifting on-wire signature.
🛰️
MikroTik, Docker & gateway mode
Ships as a tiny multi-arch FROM scratch image (~17 MB). Transparent gateway mode routes a whole LAN through the tunnel with no per-device change — validated end-to-end on a real RouterOS container and a Linux router.
📜
Real Let's Encrypt certs
With a domain, the TLS mimic serves a genuine, auto-renewing ACME certificate — CT-logged like any real HTTPS host — with a safe self-signed fallback.
🔐
Authenticated encryption
ChaCha20-Poly1305 + HKDF. The token is never sent on the wire and channel-bound auth defeats MITM — with a single crypto layer for high throughput.
⏳
Protocol-aware lifecycle
SSH is the long-lived backbone; non-SSH pipes retire on a randomized time/byte budget and churn to fresh connections — no fixed long-lived signature.
⚡
Chaos-Mesh dynamic pools
Least-loaded balancing that scales on real bandwidth, fluctuating rate caps, and zero-downtime draining — no lag when connections cycle.
📱
Full TCP + UDP
One SOCKS5 port serves TCP and UDP-over-TCP, so QUIC/HTTP3, DNS and voice/video work — on an isolated sub-pool, with no DNS leak by design.
🕵️
Decoys & active-probe resistance
Unauthorized probes get a real sshd, a DirectAdmin login, or a per-install-unique web page — even the bare IP looks like an ordinary host.
🧰
Batteries included
Non-interactive setup, in-place node editing, an interactive dashboard, safe self-update, a built-in speedtest, probe, and an egress IP-reputation check.
