What causes "phishing hostname not found" in kgretzky/evilginx2?

Add the missing subdomain/domain as a `proxy_hosts` entry in the active phishlet

phishing hostname not found

Error message

phishing hostname not found

What it means

During proxy hostname handling, when the requested hostname is not a valid lure hostname, the proxy tries to map it to a phishing hostname via replaceHostWithPhished. If that mapping also fails, the upstream TLS/cert setup cannot proceed and this error is returned. It means the proxy received a hostname it cannot translate to any configured phishing domain.

Source

Thrown at core/http_proxy.go:1564

		if len(parts) == 2 {
			port, _ = strconv.Atoi(parts[1])
		}

		tls_cfg := &tls.Config{}
		if !p.developer {

			tls_cfg.GetCertificate = p.crt_db.magic.GetCertificate
			tls_cfg.NextProtos = []string{"http/1.1", tlsalpn01.ACMETLS1Protocol} //append(tls_cfg.NextProtos, tlsalpn01.ACMETLS1Protocol)

			return tls_cfg, nil
		} else {
			var ok bool
			phish_host := ""
			if !p.cfg.IsLureHostnameValid(hostname) {
				phish_host, ok = p.replaceHostWithPhished(hostname)
				if !ok {
					log.Debug("phishing hostname not found: %s", hostname)
					return nil, fmt.Errorf("phishing hostname not found")
				}
			}

			cert, err := p.crt_db.getSelfSignedCertificate(hostname, phish_host, port)
			if err != nil {
				log.Error("http_proxy: %s", err)
				return nil, err
			}
			return &tls.Config{
				InsecureSkipVerify: true,
				Certificates:       []tls.Certificate{*cert},
			}, nil
		}
	}
}

func (p *HttpProxy) setSessionUsername(sid string, username string) {
	if sid == "" {

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add the missing subdomain/domain as a `proxy_hosts` entry in the active phishlet
Verify the lure hostname is correctly registered (`lures` / phishlet hostname) so the hostname resolves as a lure
Check that the phishlet is enabled and its hostname/subdomain parameters are set correctly
Trace the log line 'phishing hostname not found: <host>' to see which host needs coverage

Example fix

# before (phishlet missing subdomain)
proxy_hosts:
  - phish_sub: '', orig_sub: 'www', domain: 'example.com'
# after
proxy_hosts:
  - phish_sub: '', orig_sub: 'www', domain: 'example.com'
  - phish_sub: 'cdn', orig_sub: 'cdn', domain: 'example.com'

Defensive patterns

Strategy: validation

Validate before calling

if !p.cfg.IsLureHostnameValid(hostname) {
    if _, ok := p.replaceHostWithPhished(hostname); !ok {
        log.Debug("unmapped hostname: %s", hostname)
        // handle non-target host: pass through or drop
    }
}

Type guard

func isProxyableHost(p *HttpProxy, hostname string) bool {
    return p.cfg.IsLureHostnameValid(hostname) || func() bool {
        _, ok := p.replaceHostWithPhished(hostname)
        return ok
    }()
}

Try / catch

resp, err := handleRequest(req)
if err != nil && strings.Contains(err.Error(), "phishing hostname not found") {
    log.Debug("skipping non-target host %s", req.Host)
    return // graceful skip, not fatal
}

Prevention

List every subdomain the target site loads (JS, CDN, API) in proxy_hosts
Test the lure URL yourself and watch logs for 'phishing hostname not found'
Avoid linking victims to pages that request out-of-scope domains
Keep lure hostname registration in sync with phishlet hostnames

When it happens

Trigger: A client connects through the MITM proxy to a hostname that is neither a valid lure hostname nor resolvable to a phished host (no matching proxy_hosts entry in the active phishlet) — e.g. direct navigation to the proxy IP, or a site making requests to an out-of-scope subdomain while phishlet hostname replacement fails.

Common situations: Victim's browser or page JavaScript fetches a subdomain not covered by any proxy_host entry (e.g. cdn.example.com missing from the phishlet), a host_header/sub_filter references a domain not in proxy_hosts, or a user browses directly to the phishing hostname without a lure path.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/c6dfe488b860b1e8. Report an issue: GitHub.