FAQ

Trust MotmaenBash?Phishing basicsHow MotmaenBash worksAndroid permissions

Trust MotmaenBash?Important

Yes. MotmaenBash is open source, and the code can be read on GitHub.

Why MotmaenBash can be trusted:

  • The app is open source. Developers and anyone else can review the code.
  • MotmaenBash has no server of its own, and it does not upload or store that information anywhere.
  • Checks for suspicious apps, links, and other cases run offline, using the database inside the app.
  • SMS and accessibility are optional. Without them you can still scan apps and check links by hand.
  • There is no account. The app does not ask for a phone number, email address, or other account details.
  • MotmaenBash is reviewed and published by established app stores.
  • The offline database is updated from a public GitHub repository.
Open source, so anyone can review it
View the code on GitHub

No. MotmaenBash is open source and has no server of its own. Message text, links, and the list of installed apps are not uploaded or stored. Only crash reports and aggregate usage counts go to Firebase.
To check links, SMS messages, and suspicious apps, the app does not send personal information, messages, or install data to a server or a third party. Those checks run offline, on the device.

Yes. These tools are used to see that the app stays stable and to improve it:
  • Firebase Crashlytics (Google) reports crashes.
  • Firebase Analytics (Google) counts general usage.
  • Those counts include events such as how often a warning is shown. They do not include the warning text, technical details, or information that identifies a person.
  • Firebase libraries add some advertising permissions on their own. Those permissions are removed from the app manifest: 
    <!-- Remove permissions automatically added by Firebase and Google Play Services -->
    <uses-permission android:name="com.google.android.gms.permission.AD_ID" tools:node="remove" />
    <uses-permission android:name="android.permission.ACCESS_ADSERVICES_ATTRIBUTION" tools:node="remove" />
    <uses-permission android:name="android.permission.ACCESS_ADSERVICES_AD_ID" tools:node="remove" />
    <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" tools:node="remove" />

Download the app and the extensions only from the links on the MotmaenBash website.
Copies from other places may have been modified. Use the links on this website:
Get the Android app Get the browser extension
We are not responsible for installing the app or the extension from an unofficial source.

Phishing basics

Phishing is a scam that pretends to be a real organization or service and tries to steal identity details, bank information, or passwords.

  • The attacker pretends to be a trusted organization
  • The message arrives by email, SMS, or a social network
  • The page is designed to look like a real payment gateway or a known service
  • The person is pushed to enter private information
A common example: a fake SMS about a court notice. The link leads to a page that asks you to install a malicious app or enter bank details.
Attackers use several tricks:
  • Texts promising a prize or free mobile data.
  • Fake bank payment pages that collect card details.
  • Malicious apps shared in social networks and messengers.
  • Fake emails with urgent warnings, such as “your account is blocked” or “confirm your information now”.
Information entered on those pages goes to the attacker.
Common phishing:
  • Fake text messages
  • Fake bank pages
  • Malicious apps
  • Urgent emails
Bait texts
  • Free credit
  • Fake bank warnings
  • Suspicious short links
Fake apps
  • Copies of banking apps
  • Copies of government apps
  • Unknown VPN tools

Look for these signs:
  • Spelling and grammar mistakes
  • Shortened or unusual links
  • Bait such as “you have won a prize” or “you have an unpaid toll”
  • Claims about a subsidy payment, or that you were removed from a payment list
  • A message pretending to be the judiciary and asking you to open a notice or a case
  • A personal phone number instead of an official sender such as adliran
  • A request for personal information, a card password, or a confirmation code
  • A threat such as “your account will be blocked if you do not pay”

Look for these signs:
  • A sender domain that only looks real, such as support@google-support.com instead of @google.com
  • Shortened or unusual links
  • A link domain that only looks real, such as inistagram.com instead of instagram.com
  • A request for private information after you open a link, such as a username and password
  • Urgent threats, such as losing access to the account
  • An attachment you were not expecting

These habits help:
  • Learn the current tricks, and warn people around you
  • Look at the site carefully before entering information
  • Install mobile apps only from official stores
  • Pay attention to warnings from the browser and other security tools
  • Do not enter information on a site you do not know
  • Delete suspicious texts and emails
  • Do not open unexpected links in messengers, social networks, SMS, or email
  • Do not install unknown apps, including VPNs, from Telegram or other messengers
  • Install MotmaenBash for yourself and for family members:
Get the MotmaenBash app Get the MotmaenBash extension

How MotmaenBash works

The Android app uses the checks below. 🚀

SMS
  • Checks new SMS messages and flags suspicious ones
  • Scans links in those messages and warns you
  • Shows a warning when a message looks suspicious
Browser
  • Checks links opened in the browser
  • Shows a green confirmation on genuine Shaparak payment pages
  • Warns you immediately about a suspicious or misleading site
Apps
  • Warns you when a suspicious app is installed
  • Can scan apps that are already installed
  • Warns you about apps that ask for suspicious permissions
General
  • Shows short security tips on the home screen.
  • Updates the database as new threats appear.
  • Works offline, at the moment the message, link, or app is seen.
  • Lets people report new scams, and those reports improve the database.

No. The app does not upload user information to a server, it works offline, and it has no central server. Suspicious links, phishing SMS, and malicious apps are checked on the device. The on-device database is updated from a GitHub repository, and that update does not send anything about you.

The browser extension does two things:
  • Checks the address of payment gateways
  • Shows a green mark when the payment gateway looks genuine

Use the report form for phishing SMS messages, sites, and apps. Reports help MotmaenBash recognize more cases.

Send a report

Yes. It is free to use. The app may show text or image ads, either for a while or permanently.

The browsing shield currently supports:
Chrome, Firefox, Microsoft Edge, Opera, Brave, DuckDuckGo, Samsung Internet, UC Browser, and Qwant.
More browsers may be added later.
Older browser versions can behave differently. The shield is checked against current versions, so keep your browser updated.

Android permissions

Internet is used to update the database. Network-state access avoids errors when the phone is offline.

This permission is how the app sees a new SMS and checks it for phishing. It covers only the message that just arrived. The app cannot send SMS, and it cannot read messages already stored on the phone.
This permission is optional. Without it you can still scan apps, check links by hand, and read the security tips. It does not allow sending SMS or reading older messages.

The browsing shield uses accessibility to notice links and pages while you browse, and to warn you about dangerous ones. On a payment page it can also tell you when the gateway belongs to Shaparak.
This permission is optional. Without it you can still scan apps, check links by hand, and read the security tips.

Warnings use this permission, so they can appear while you are in another app.

The app scan needs the list of installed apps so it can look for suspicious and phishing apps.

When the app finds a suspicious program, it can offer to uninstall it. This permission only sends that request to Android. Nothing is removed unless you confirm it.

From Android 8, this permission keeps the SMS, browsing, and install shields running. Older Android versions do not grant it.

This permission is for the foreground service that syncs data. It is requested from Android 10 upward.

From Android 8, a foreground service has to show a notification so you can see that it is running. The app may also use a notification for news such as a new version.

This permission starts the app again after the phone restarts, so the shields keep working.

The phone vibrates when a warning appears for a suspicious SMS, link, or app.

Yes. Turning a permission off limits what the app can do. Without SMS access, for example, it cannot check phishing texts. Leave the permissions on if you want every shield.

Other questions

MotmaenBash is available for Android only. iOS does not allow the same access to SMS, browsing, and installed apps, so the same features are not practical there.

No. MotmaenBash is built to catch phishing: suspicious SMS, phishing sites, and malicious apps. It is not a replacement for antivirus software.