{"record":{"id":"ae02aaac906b1620","repo":"kgretzky/evilginx2","slug":"login-domain-must-contain-a-value-of-one-of-the","errorCode":null,"errorMessage":"login: `domain` must contain a value of one of the hostnames (`orig_subdomain` + `domain`) defined in `proxy_hosts` section","messagePattern":"login: `domain` must contain a value of one of the hostnames \\(`orig_subdomain` \\+ `domain`\\) defined in `proxy_hosts` section","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/phishlet.go","lineNumber":658,"sourceCode":"\t}\n\tp.login.domain = p.paramVal(*fp.LoginItem.Domain)\n\tif p.login.domain == \"\" {\n\t\treturn fmt.Errorf(\"login: `domain` field cannot be empty\")\n\t}\n\tlogin_domain_ok := false\n\tfor _, h := range p.proxyHosts {\n\t\tvar check_host string\n\t\tif h.orig_subdomain != \"\" {\n\t\t\tcheck_host = h.orig_subdomain + \".\"\n\t\t}\n\t\tcheck_host += h.domain\n\t\tif strings.ToLower(check_host) == strings.ToLower(p.login.domain) {\n\t\t\tlogin_domain_ok = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !login_domain_ok {\n\t\treturn fmt.Errorf(\"login: `domain` must contain a value of one of the hostnames (`orig_subdomain` + `domain`) defined in `proxy_hosts` section\")\n\t}\n\n\tp.login.path = p.paramVal(*fp.LoginItem.Path)\n\tif p.login.path == \"\" {\n\t\tp.login.path = \"/\"\n\t}\n\tif p.login.path[0] != '/' {\n\t\tp.login.path = \"/\" + p.login.path\n\t}\n\n\tif fp.Credentials.Custom != nil {\n\t\tfor _, cp := range *fp.Credentials.Custom {\n\t\t\tvar err error\n\t\t\tif cp.Key == nil {\n\t\t\t\treturn fmt.Errorf(\"credentials: missing custom `key` field\")\n\t\t\t}\n\t\t\tif cp.Search == nil {\n\t\t\t\treturn fmt.Errorf(\"credentials: missing custom `search` field\")","sourceCodeStart":640,"sourceCodeEnd":676,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/phishlet.go#L640-L676","documentation":"The `login.domain` value must match (case-insensitively) one of the hostnames derived from the `proxy_hosts` section (`orig_subdomain` + \".\" + `domain`, optionally with a leading `*.` check). If it does not correspond to any proxy host, loading aborts because Evilginx could not route the login page through any proxied host.","triggerScenarios":"`login.domain` set to a hostname like `login.example.com` while proxy_hosts only defines `accounts.example.com`; or a typo/top-level mismatch (e.g. `example.org` vs `example.com`); or omitting the subdomain when proxy_hosts expects `orig_subdomain.domain`.","commonSituations":"Renaming proxy_hosts after writing the login block; copying a phishlet for one site and editing only the domain; mixing up `phish_sub` (your phishing subdomain) with `orig_sub` (must be the orig one).","solutions":["Set `login.domain` to exactly `orig_sub + \".\" + domain` as written in one of the proxy_hosts entries.","If the login happens on a different host, add a matching proxy_hosts entry for that host.","Do not use the phishing (phish_sub) hostname in login.domain — it must be the original one.","Re-check for typos and case; matching is case-insensitive but text must otherwise be identical."],"exampleFix":"// before\nproxy_hosts:\n  - phish_sub: acct\n    orig_sub: accounts\n    domain: example.com\nlogin:\n  domain: login.example.com\n// after\nlogin:\n  domain: accounts.example.com","handlingStrategy":"validation","validationCode":"d := strings.ToLower(pl.Login.Domain)\nok := false\nfor _, h := range pl.ProxyHosts {\n    if strings.ToLower(h.OrigSubdomain+\".\"+h.Domain) == d { ok = true; break }\n}\nif !ok {\n    return fmt.Errorf(\"login.domain %q not found in proxy_hosts\", pl.Login.Domain)\n}","typeGuard":"func loginDomainMatches(l *LoginItem, hosts []ProxyHost) bool {\n    if l == nil || l.Domain == nil { return false }\n    for _, h := range hosts {\n        if strings.EqualFold(h.OrigSubdomain+\".\"+h.Domain, *l.Domain) { return true }\n    }\n    return false\n}","tryCatchPattern":"if err := pl.Load(cfg); err != nil {\n    if strings.Contains(err.Error(), \"must contain a value of one of the hostnames\") {\n        log.Printf(\"login.domain must equal orig_sub+'.'+domain of a proxy_host in %s\", pl.Name)\n    }\n}","preventionTips":["Use the original hostname (orig_subdomain.domain), never the phishing subdomain.","Update login.domain whenever you edit proxy_hosts.","Add the login host as its own proxy_hosts entry if the form lives on another subdomain.","Run an automated consistency check across phishlets."],"tags":["configuration","phishlet","validation","hostname"],"backgroundTag":"hostname-mismatch","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}