{"record":{"id":"c6dfe488b860b1e8","repo":"kgretzky/evilginx2","slug":"phishing-hostname-not-found","errorCode":null,"errorMessage":"phishing hostname not found","messagePattern":"phishing hostname not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/http_proxy.go","lineNumber":1564,"sourceCode":"\t\tif len(parts) == 2 {\n\t\t\tport, _ = strconv.Atoi(parts[1])\n\t\t}\n\n\t\ttls_cfg := &tls.Config{}\n\t\tif !p.developer {\n\n\t\t\ttls_cfg.GetCertificate = p.crt_db.magic.GetCertificate\n\t\t\ttls_cfg.NextProtos = []string{\"http/1.1\", tlsalpn01.ACMETLS1Protocol} //append(tls_cfg.NextProtos, tlsalpn01.ACMETLS1Protocol)\n\n\t\t\treturn tls_cfg, nil\n\t\t} else {\n\t\t\tvar ok bool\n\t\t\tphish_host := \"\"\n\t\t\tif !p.cfg.IsLureHostnameValid(hostname) {\n\t\t\t\tphish_host, ok = p.replaceHostWithPhished(hostname)\n\t\t\t\tif !ok {\n\t\t\t\t\tlog.Debug(\"phishing hostname not found: %s\", hostname)\n\t\t\t\t\treturn nil, fmt.Errorf(\"phishing hostname not found\")\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tcert, err := p.crt_db.getSelfSignedCertificate(hostname, phish_host, port)\n\t\t\tif err != nil {\n\t\t\t\tlog.Error(\"http_proxy: %s\", err)\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\treturn &tls.Config{\n\t\t\t\tInsecureSkipVerify: true,\n\t\t\t\tCertificates:       []tls.Certificate{*cert},\n\t\t\t}, nil\n\t\t}\n\t}\n}\n\nfunc (p *HttpProxy) setSessionUsername(sid string, username string) {\n\tif sid == \"\" {","sourceCodeStart":1546,"sourceCodeEnd":1582,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/http_proxy.go#L1546-L1582","documentation":"During proxy hostname handling, when the requested hostname is not a valid lure hostname, the proxy tries to map it to a phishing hostname via replaceHostWithPhished. If that mapping also fails, the upstream TLS/cert setup cannot proceed and this error is returned. It means the proxy received a hostname it cannot translate to any configured phishing domain.","triggerScenarios":"A client connects through the MITM proxy to a hostname that is neither a valid lure hostname nor resolvable to a phished host (no matching proxy_hosts entry in the active phishlet) — e.g. direct navigation to the proxy IP, or a site making requests to an out-of-scope subdomain while phishlet hostname replacement fails.","commonSituations":"Victim's browser or page JavaScript fetches a subdomain not covered by any proxy_host entry (e.g. cdn.example.com missing from the phishlet), a host_header/sub_filter references a domain not in proxy_hosts, or a user browses directly to the phishing hostname without a lure path.","solutions":["Add the missing subdomain/domain as a `proxy_hosts` entry in the active phishlet","Verify the lure hostname is correctly registered (`lures` / phishlet hostname) so the hostname resolves as a lure","Check that the phishlet is enabled and its hostname/subdomain parameters are set correctly","Trace the log line 'phishing hostname not found: <host>' to see which host needs coverage"],"exampleFix":"# before (phishlet missing subdomain)\nproxy_hosts:\n  - phish_sub: '', orig_sub: 'www', domain: 'example.com'\n# after\nproxy_hosts:\n  - phish_sub: '', orig_sub: 'www', domain: 'example.com'\n  - phish_sub: 'cdn', orig_sub: 'cdn', domain: 'example.com'","handlingStrategy":"validation","validationCode":"if !p.cfg.IsLureHostnameValid(hostname) {\n    if _, ok := p.replaceHostWithPhished(hostname); !ok {\n        log.Debug(\"unmapped hostname: %s\", hostname)\n        // handle non-target host: pass through or drop\n    }\n}","typeGuard":"func isProxyableHost(p *HttpProxy, hostname string) bool {\n    return p.cfg.IsLureHostnameValid(hostname) || func() bool {\n        _, ok := p.replaceHostWithPhished(hostname)\n        return ok\n    }()\n}","tryCatchPattern":"resp, err := handleRequest(req)\nif err != nil && strings.Contains(err.Error(), \"phishing hostname not found\") {\n    log.Debug(\"skipping non-target host %s\", req.Host)\n    return // graceful skip, not fatal\n}","preventionTips":["List every subdomain the target site loads (JS, CDN, API) in proxy_hosts","Test the lure URL yourself and watch logs for 'phishing hostname not found'","Avoid linking victims to pages that request out-of-scope domains","Keep lure hostname registration in sync with phishlet hostnames"],"tags":["proxy","hostname","mitm","phishlet"],"backgroundTag":"hostname-not-mapped","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}