Evilginx
43 hosts convicted as Evilginx phishing servers: 43 still listed, 0 archived. First seen 2026-08-28.
About
Evilginx is an open-source adversary-in-the-middle phishing framework: it proxies a real sign-in page to the victim and captures the credentials AND the session cookie, defeating most multi-factor prompts. A listed address is a live phishing proxy, not a beacon controller.
Ports
Observed changes
New networks for this family in this archive, last 7 days: AS212228 on 2026-10-29 (1 host); AS200019 on 2026-10-27 (1 host); AS395904 on 2026-10-26 (1 host); AS402722 on 2026-10-26 (1 host); AS26666 on 2026-10-25 (1 host).
Detection packs
Rules for this hub's 43 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.