Phishing.club Webhook Receiver#

InfraGuard accepts HMAC-signed webhooks from Phishing.club, a phishing framework that sends event callbacks when targets interact with campaigns. Events are ingested into InfraGuard’s tracking database and plugin pipeline, giving you a unified view of both C2 and phishing activity through the same dashboard.

Configuration#

integrations:
  phishingclub:
    enabled: true
    webhook_path: "/_hooks/phishingclub"
    hmac_secret: "${PHISHINGCLUB_HMAC_SECRET}"
    whitelist_clicking_ips: true    # auto-allowlist IPs that click phishing links

Webhook Signature Verification#

Every incoming webhook is verified against the X-Signature header using HMAC-SHA256:

InfraGuard computes HMAC-SHA256(shared_secret, request_body)
Compares the result against the X-Signature header value
If they don’t match, the request is rejected with 403

This prevents attackers from injecting fake events into your tracking pipeline.

Supported Events#

Event Type	Description	High-Value
`email_opened`	Target opened the phishing email	No
`link_clicked`	Target clicked the phishing link	No
`page_visited`	Target visited the phishing page	No
`data_submitted`	Target submitted form data	Yes
`credentials_submitted`	Target entered credentials	Yes
`oauth_token_captured`	OAuth token captured via device code or consent flow	Yes
`device_code_captured`	Device code flow token captured	Yes
`mfa_submitted`	Target entered MFA code	Yes

High-value events trigger elevated alerts through the plugin pipeline (Discord, Slack, Wazuh, etc.).

IP Whitelisting#

When whitelist_clicking_ips: true, IPs that click phishing links are automatically added to InfraGuard’s IP allowlist. This prevents the redirector’s filter pipeline from blocking follow-up requests from targets who are actively engaging with the phishing campaign.

Without this, a target who clicks a phishing link and then gets redirected through InfraGuard might be blocked by the sandbox filter or profile filter, since their browser behavior may not perfectly match the expected C2 profile.

Event Pipeline#

Phishing.club events are converted into synthetic RequestEvent objects and dispatched through the normal plugin pipeline:

Phishing.club --> Webhook --> HMAC Verify --> RequestEvent
                                                  |
                                          Plugin Pipeline
                                          (Discord, Slack, Wazuh)

The synthetic event uses the phishing event type as the method field and the webhook path as the uri, making it easy to filter phishing events in queries and reports.

Webhook Endpoint#

POST /_hooks/phishingclub
Content-Type: application/json
X-Signature: <hmac-sha256-hex>

{
  "event": "credentials_submitted",
  "target_email": "victim@corp.com",
  "source_ip": "198.51.100.23",
  "timestamp": "2025-03-15T14:30:00Z",
  "data": { ... }
}