Ph1shy v2.0.0: The Forum Post Said "Phishing Panel." The Source Code Said Otherwise.

• Classification: TLP:WHITE
• Threat type: Phishing-as-a-Service

---

DISCLAIMER: This investigation was conducted entirely through passive data collection and static analysis of publicly accessible resources. OSINT collection used WHOIS, certificate transparency logs, public DNS, internet-wide banner scanning platform data, and publicly served web resources. The Ph1shy frontend was cloned from a publicly accessible web server serving static JavaScript assets; no authentication was bypassed and no systems were modified, disrupted, or exploited. The analysis is based entirely on unauthenticated, static, publicly served content. This post is published as a threat intelligence disclosure in the public interest to assist defenders and inform takedown efforts.

---

TL;DR: Ph1shy v2.0.0 was advertised on BreachForums as a $500 phishing panel with five basic features. Static analysis of its cloned Next.js frontend reveals a full-spectrum criminal operations platform: email campaign management, SIP-based vishing, automated doxxing via Snusbase, credential validation, a lead CRM, reverse proxy provisioning, in-panel domain registration, target investigation mindmaps, and ScreenConnect-based post-exploitation, exposed through 100+ API endpoint methods across 15 integrated modules. We mapped the operator's infrastructure to six servers in Zurich, Switzerland and Stockholm, Sweden, tied it to the exploit.in handle ZloyNginR, and found zero prior public technical coverage of the kit.

---

Contents

1. Discovery, finding Ph1shy in the wild
2. The advertisement, what ph1shyfam was selling
3. Infrastructure deep dive
4. The panel, what the screenshots show
5. The source code, what the forum post did not mention
6. The complete attack chain
7. Who is behind Ph1shy
8. Where Ph1shy sits in the PhaaS landscape
9. MITRE ATT&CK mapping
10. Key takeaways
11. Indicators of compromise

---

The forum post promised five features. The source code delivered fifteen modules. That gap is the story.

Ph1shy v2.0.0 appeared on BreachForums in late June 2026, advertised by a user called ph1shyfam as "the #1 phishing panel." The listing was modest: WebSocket-based real-time updates, custom templates, multi-server support, multi-user accounts, and JavaScript execution on victim browsers. Price: $500 for a panel license, $1,000 for the source. Templates for Coinbase and Okta sold separately at $100 each. Payment in crypto. Standard fare for the PhaaS market.

But when we cloned the frontend from a live Ph1shy instance and started reading the JavaScript, the picture changed completely. What the forum post described as a "phishing panel" turned out to be a full-spectrum criminal operations platform with integrated email campaign management, VoIP/vishing via SIP, automated doxxing through Snusbase, credential checking, a CRM for managing lead databases, reverse proxy infrastructure provisioning, domain registration, target investigation mindmaps, and ScreenConnect-based post-exploitation. The API client alone contains over 100 endpoint methods across 15 integrated modules.

Zero Tier-1 vendor publications or news outlets have covered this kit. The only external mention we found was a TechOwl Shield blog post from February 2026 that now returns HTTP 403. This is the first public technical analysis of Ph1shy.

---

1. Discovery, Finding Ph1shy in the Wild

The investigation started with internet scanning for web servers whose HTML body contained the string "ph1shy." Two live panel instances came back, both running on port 5000, both presenting a dark-themed login page branded with a fish icon and the text "ph1shy v2.0.0."

The first was at 209.99.190.74:5000, resolving to the hostname daboss.mailbox-support[.]com. The second was at 209.99.191.9:5000, with no hostname. Both were in Zurich, Switzerland, on AS402253 (SKN Subnet & Telecom Ltd). Same ASN, same city, same kit version. This was one operator's infrastructure.

The panel at 209.99.190.74:5000 was still live at the time of analysis. We cloned the static frontend assets served by the Next.js application, which gave us the JavaScript chunks, including the complete API client. This is where the investigation pivoted from infrastructure enumeration to source code analysis.

---

2. The Advertisement, What ph1shyfam Was Selling

Before we get into what we found in the source code, it is worth understanding what the actor chose to disclose publicly. The BreachForums post, titled "ph1shy v2.0.0 - #1 phishing panel updated pricing", went up on June 24, 2026.

The listing described the stack as "Golang + React" and named five features:

1. Instant Updates via WebSocket for real-time phish management
2. Custom Templates with operator-supplied HTML + CSS
3. Phishing Servers with multi-server support under one instance
4. User System with unlimited operator accounts
5. Phishing System with page switching, JS execution, network requests, and victim redirect

Contact was through on-site DM, Telegram (@ph1shyfam), or Tox. Payment in any major cryptocurrency.

The "updated pricing" in the title is interesting on its own. A now-inaccessible TechOwl Shield blog post from February 2026 reportedly listed Ph1shy at $1,500 for a panel license and $10,000 for source code. By June, those prices had dropped to $500 and $1,000 respectively. That kind of price collapse typically signals either competitive pressure from other PhaaS kits, or a strategic decision to pursue volume over exclusivity. Given that Ph1shy appeared in the same timeframe as the post-Tycoon 2FA wave of new kits, competition seems like the more likely driver.

---

3. Infrastructure Deep Dive

The infrastructure we mapped paints a picture that goes well beyond what you would expect from a standalone phishing panel. The operator runs phishing panels, a ScreenConnect remote access C2, a self-hosted Gitea code repository, a Postfix SMTP server, SOCKS5 proxies, HTTP proxies, and a download distribution server. All of this is concentrated across a small number of servers.

Primary: 209.99.190.74

• Hostname: daboss.mailbox-support[.]com
• Location: Zurich, Switzerland
• ASN: AS402253 (SKN Subnet & Telecom Ltd)

This is the primary operator box. The Ph1shy panel runs on port 5000 while a self-hosted Gitea instance on port 443 serves as the source code repository. The presence of RDP, WinRM, SMB, and DCERPC on the same host suggests this is a Windows server, possibly the developer's own workstation or a dedicated development machine. The SOCKS5 proxy on 10801 and HTTP proxies on 40000/60000 provide tunneling capability. This server is doing a lot of work.

Primary: 209.99.190.191

• Hostname(s): server.deepcoracert[.]com, mail.mailbox-support[.]com
• Location: Zurich, Switzerland
• ASN: AS402253 (SKN Subnet & Telecom Ltd)

The second primary server hosts two particularly important services. ScreenConnect (ConnectWise Control) on port 443 under server.deepcoracert[.]com provides the operator with remote access to victim machines after credential-based social engineering. A legitimate remote management tool being used for post-exploitation is a well-documented TTP, but seeing it co-located with the phishing infrastructure on the same ASN makes the relationship explicit. Postfix SMTP on port 587, accessible via mail.mailbox-support[.]com, handles phishing email delivery. This server is likely the backend for the PHISHY-MAILER service identified in the source code.

Secondary: 209.99.191.9

• Hostname: none observed
• Location: Zurich, Switzerland
• ASN: AS402253 (SKN Subnet & Telecom Ltd)

A second Ph1shy instance with minimal services. This could be a customer deployment, a staging environment, or a demo box. The lack of a hostname is notable since the primary instance uses daboss.mailbox-support[.]com.

Secondary: 185.177.239.175

• Hostname: downloads.deepcoracert[.]com
• Location: Stockholm, Sweden
• ASN: AS209946 (ALINDA LLC)

The only non-Zurich server in the cluster. downloads.deepcoracert[.]com on a different ASN (ALINDA LLC, Sweden) serves as the distribution point for kit binaries and updates. Separating the download server from the operational infrastructure is a basic operational security practice.

Tertiary Infrastructure

148.230.86.206

• Hostname: mailbox-support[.]com (A record)
• Location: Boston, MA, United States
• ASN: AS47583 (Hostinger Intl.)
• Role: Domain hosting

86.54.42.155

• Hostname: server.deepcoracert[.]com (historical SSH)
• Location: United Kingdom
• ASN: Unknown
• Role: SSH (historical, port 22)

Domain Intelligence

Two domains anchor the infrastructure, and they tell different stories about how the operator handles registration.

mailbox-support[.]com was registered on July 21, 2026, through PublicDomainRegistry with Cloudflare nameservers (carlos.ns.cloudflare.com and raquel.ns.cloudflare.com). No DMARC record, and SPF is set to ~all (softfail), which is essentially no protection. The subdomain daboss. hosts the primary Ph1shy panel. Passive DNS shows historical IPs: 159.65.83.69 (January to November 2022, which also hosted biz.novintec[.]cfd) and 23.236.62.147 (January to May 2020, shared hosting with 1000+ domains).

deepcoracert[.]com, registered on November 7, 2025, through Tucows Domains, uses a very different approach. Its nameservers are 1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo.

Key Finding: deepcoracert[.]com uses Njalla nameservers, a privacy-focused DNS provider documented in Push Security's ShinyHunters/BlackFile investigation as preferred infrastructure for phishing operators (AS39287 Njalla). The combination of Njalla DNS, self-signed certificates, no CT log presence, and ScreenConnect on port 443 is a strong malicious-intent signal.

No SPF, no DMARC, no certificates in Certificate Transparency logs. Subdomains server. (ScreenConnect) and downloads. (kit distribution) are purpose-built for operational use. The Njalla choice is deliberate, and not the kind of thing you see from a legitimate SaaS vendor.

---

4. The Panel, What the Screenshots Show

The forum post included several screenshots of the Ph1shy dashboard. Combined with the screenshots we captured during our investigation, they reveal the panel's user interface and core workflow.

The dashboard is clean and functional. The left sidebar organizes everything into two sections: operational (Phishes, Targets) and administrative (Phishing Templates, Phishing Servers, Users, Settings). The main view is a session table showing each connected victim's IP, geolocation, connection status, the template being served, and the phishing server port. The "CONNECTED" badge in green shows real-time status. The :5500 server port is separate from the :5000 admin panel, meaning the victim-facing phishing pages are served on a different port than the management interface.

The Phish Details view is where the real-time C2 capability becomes visible. Each connected victim session gets a unique UUID. The operator has immediate access to five controls: Change Page (swap the phishing page served to the victim mid-session), Execute (inject and run JavaScript in the victim's browser), Disconnect (terminate the session), Redirect Phish (send the victim to a legitimate site after credential capture), and Download (export captured session data). The "Submitted Data" tab stores whatever the victim has entered into the phishing forms.

The Change Page dialog is the mechanism behind multi-step phishing flows. In this screenshot, the operator is switching from the "support" page to a "Loading" page while keeping the title as "Coinbase - Sign in." This is the kind of control you need for an AiTM (adversary-in-the-middle) phishing attack where the victim thinks they are going through a real authentication flow but each step is being controlled by the operator in real time. Login page, then a spinner while the operator relays credentials to the real site, then an MFA prompt to capture the second factor, then redirect to the legitimate service so the victim does not get suspicious.

---

5. The Source Code, What the Forum Post Did Not Mention

This is where the investigation turned from a standard PhaaS enumeration exercise into something more significant. The cloned frontend from 209.99.190.74:5000 included the Next.js static export, and within it, a JavaScript chunk named 1159-1c262abc0e18ebc9.js that contains the complete API client for the Ph1shy platform.

The forum post advertised 5 capabilities. The API client exposes 15+ integrated modules with over 100 endpoint methods. Whoever wrote that forum post was either deliberately downplaying the kit's capabilities or simply did not bother listing everything. Either way, the gap between advertisement and reality is enormous.

Critical Finding: Ph1shy is not a phishing panel. It is a full-spectrum criminal operations platform combining credential harvesting, VoIP/vishing, automated OSINT/doxxing, email campaign management, credential validation, CRM-style lead management, reverse proxy provisioning, domain purchasing, and target investigation boards. Nothing in the public record describes a PhaaS kit with this breadth of integrated capability.

Technical Stack

The forum post described the stack as "Golang + React." The source code is more specific: the frontend is Next.js 15.1.7 using the App Router with React Server Components. It is not plain React. The backend is confirmed Golang, serving the Next.js static export and providing the API at /api.

This is a modern, professionally built application. Tailwind CSS v4, Radix UI primitives, Sonner toasts, proper theme management. The developer knows what they are doing, and the code quality reflects someone who is building a product, not hacking together a one-off.

Authentication System

The login page in page-171b7f316eb8857b.js reveals the auth flow. The Go backend enforces server-side token validation before serving any page. All unauthenticated requests get a 302 redirect to /auth/login. This is not just a client-side check that can be bypassed with a cookie injection; we tested this and confirmed the backend validates the token before routing.

On successful login, the panel stores a "token" cookie with a 24-hour expiry and redirects to the dashboard. The login success toast reads: "Succesfully logged in! Get to ph1shing" (note the misspelling of "Successfully," which is a useful fingerprinting artifact). All subsequent API requests parse the token from the cookie and send it as an Authorization header.

The auth flow supports multi-factor authentication. A login can return an OTP challenge, which routes the user to /auth/otp for a second factor. There is also a forced password change flow for first-time logins. This level of authentication sophistication in a criminal tool is notable: the operator cared enough to build MFA and password rotation into their own platform.

The Hidden Modules

The following table compares what the forum post advertised versus what the source code reveals. Every bolded row is a capability that was never mentioned in any public advertisement.

Ten undisclosed modules. Each one discovered exclusively through static analysis of the API client in 1159-1c262abc0e18ebc9.js.

Module Breakdown

The Mailer is a full email campaign manager. The API exposes endpoints for managing SMTP accounts, creating template groups with variables and presets, managing mail accounts, and sending emails with both a send and send-fa endpoint (the latter likely "send from address" or a "send all" variant). Crucially, the mailer supports two service types: standard SMTP and a proprietary service called PHISHY-MAILER. The PHISHY-MAILER type requires mTLS configuration with a CA certificate, client certificate, and client key. This means Ph1shy operates a dedicated email delivery backend, likely the Postfix server on 209.99.190.191:587.

The Caller/Vishing module follows the exact same pattern. SIP integration with host, port, extension, local IP, and public IP configuration for standard VoIP. And a second service type, PHISHY-CALLER, that uses the same mTLS certificate model as PHISHY-MAILER. The caller module supports audio file upload (for robocalling), phone number import from the auto-doxer, and lead group assignment. This is a complete vishing operations system integrated directly into the phishing platform.

Proprietary mTLS Services: Both PHISHY-MAILER and PHISHY-CALLER use mutual TLS with CA certificate, client certificate, and client key authentication. This indicates dedicated backend infrastructure separate from the panel itself, operated by the Ph1shy developer, that customers connect to via authenticated encrypted channels. The operator is not just selling a panel; they are running backend services for their customers.

The Auto-Doxer automates victim enrichment through the Snusbase API, a service that provides access to breached credential databases. Operators create an autodoxer instance with their Snusbase API key and configure regex patterns. The module runs automated lookups on leads and imports enriched data (emails, phone numbers, additional identifiers) back into the lead management system. The pipeline is: import leads -> auto-dox against breach data -> feed enriched leads into the mailer or caller for targeting.

The Credential Checker validates stolen credentials against live services. It supports typed checkers (implying different validation methods for different target services), paginated results, and export. After a phishing campaign captures credentials, this module lets the operator verify which ones actually work before selling them or using them for account takeover.

The Lead CRM is where all the targeting data converges. Leads have email, name, and phone fields. They can be imported from files, from the auto-doxer output, or entered manually. The module includes "connection detection" (identifying relationships between leads across datasets) and "lead runners" (likely automated workflows that process leads through the attack pipeline). Lead groups organize targets by campaign.

The Reverse Proxy Manager automates the deployment of phishing infrastructure on remote servers. Given SSH credentials for a remote host, it installs nginx, certbot, and a custom service, then configures HTTPS certificates automatically. This turns domain provisioning from a manual process into a button click. The endpoint structure includes domain management and installation actions, meaning a Ph1shy operator can spin up a new phishing domain with valid HTTPS in minutes.

Domain Registrar Integration takes this a step further. The module connects to domain registrar APIs with provider keys, checks domain availability, queries account balances, and purchases domains. The operator never needs to leave the Ph1shy panel to acquire new phishing domains.

Target Mindmaps provide visual investigation boards with a graph structure (nodes and edges). Each target gets a mindmap where the operator can map relationships, annotate sub-targets, and add notes. This is closer to what you would expect from a threat intelligence platform than a phishing kit.

The Data Store is a generic file management module with upload, search, and a paginated line viewer. Given the context, this is almost certainly used for managing combolists and breach data files, providing the raw material that feeds the auto-doxer and credential checker.

RBAC Permissions add multi-operator access control with permission groups and user-group assignment. Combined with the activity logging module (which provides a paginated, searchable audit trail of all operator actions), this gives Ph1shy the kind of governance features you would see in enterprise software. A criminal enterprise running operations at scale needs to know who did what and when, and Ph1shy provides that.

Complete API Module Map

WebSocket C2

The WebSocket URL is constructed dynamically: ({https ? wss : ws}) + window.location.host + path. A dedicated endpoint at /api/settings/ws-connections lists all active WebSocket connections, confirming the real-time C2 capability for both victim sessions and operator panels. Every page change, credential submission, JS execution, and status update flows through the WebSocket in real time.

---

6. The Complete Attack Chain

When you put the infrastructure and the source code together, what emerges is a complete attack lifecycle that covers every stage from development to post-exploitation.

This is not a phishing panel with some add-ons. This is an integrated criminal operations platform where every stage of the attack chain is handled within a single UI. The operator can research targets, purchase domains, deploy phishing infrastructure, send email lures and robocalls, harvest credentials in real time, validate stolen credentials, and access victim machines, all without leaving the Ph1shy dashboard.

---

7. Who Is Behind Ph1shy

The actor operates under multiple handles across different platforms. The primary identity on BreachForums and Telegram is ph1shyfam. On exploit.in, the handle is ZloyNginR, active since April 2023. The subdomain daboss.mailbox-support[.]com suggests a third handle or nickname: daboss.

Identities

• ph1shyfam - BreachForums, Telegram (@ph1shyfam)
• ZloyNginR - exploit.in (since April 2023)
• Ph1shy - GitHub (unverified, username match alone is insufficient for attribution)
• daboss - subdomain handle (daboss.mailbox-support[.]com)

Confirmed Presence

• BreachForums - ph1shyfam (joined Feb 2026, 8 posts)
• exploit.in - ZloyNginR (since April 2023)
• Telegram - @ph1shyfam
• Infrastructure - daboss.mailbox-support[.]com subdomain

Contact / Comms

• Telegram - @ph1shyfam
• Tox - 6D7FF889250D4950192689DABD12413A5364D28397ABEF4583DC28EDE2D8EE400374247FECD4
• Payment - Major cryptocurrencies
• Forums - BreachForums, exploit.in

Tools Sold

• Ph1shy v2.0.0 - PhaaS platform (Golang + Next.js)
• FishScale - Golang reverse proxy (Evilginx alternative with WAF bypass)
• Coinbase template - $100 add-on
• Okta template - $100 add-on

Attribution Confidence: The link between ph1shyfam and ZloyNginR comes from TechOwl Shield search snippets (the full article returns 403). Both handles sell Ph1shy and FishScale, both advertise Golang-based tools. Username enumeration found accounts matching "ph1shy" on GitHub, Docker Hub, Bluesky, Chess.com, Facebook, and Duolingo, but none of these can be verified as belonging to the threat actor. Username match alone is insufficient for attribution.

The BreachForums profile shows ph1shyfam joined in February 2026 with 8 posts, 2 threads, and 0 reputation. The anime-style avatar and "MEMBER" badge (no special status) suggest a relatively new seller on that platform. The exploit.in account under ZloyNginR is older, dating to April 2023, which gives a longer timeline for the actor's operations.

FishScale is worth mentioning separately. Sold by the same actor (ZloyNginR), it is described as a Golang reverse proxy, essentially an Evilginx alternative with WAF bypass. Given that the Ph1shy source code includes a reverse proxy management module with automated nginx/certbot deployment, FishScale may be the dedicated reverse proxy component that integrates with Ph1shy, or it could be a standalone product. Either way, the same operator is selling both the phishing panel and the infrastructure tool to deploy it.

---

8. Where Ph1shy Sits in the PhaaS Landscape

Ph1shy is part of the post-Tycoon 2FA ecosystem. After the March 2026 Europol-coordinated takedown of Tycoon 2FA infrastructure, the PhaaS market fragmented into multiple successor kits, each trying to fill the gap. Different vendors name different successors; the landscape is messy.

Among these, JWR is the closest architectural match: both use WebSocket-based real-time C2 for victim session management, and both are built with modern JavaScript frameworks (Vue.js for JWR, Next.js for Ph1shy). However, Ph1shy's breadth of integrated modules puts it in a different category entirely. JWR is a phishing kit. Ph1shy is an operations platform that happens to include phishing.

The "v2.0.0" version number also implies history. There was a v1. The kit has been through at least one major iteration, and the current version reflects a deliberate product development effort, not a first attempt.

---

9. MITRE ATT&CK Mapping

Mapping Basis: TTPs mapped from confirmed infrastructure, panel screenshots, and source code analysis of the cloned panel frontend. Techniques marked inferred are assessed from context but not directly observed.

---

10. Key Takeaways

1. Forum posts lie by omission. Ph1shy's public advertisement described a basic phishing panel with five features. The source code reveals a fifteen-module criminal operations platform. If you are tracking PhaaS threats, the forum listing is not your ground truth. The code is. Whenever possible, get your hands on the actual kit or its frontend assets and read them.

2. PhaaS is becoming full-stack. The integration of email campaigns, VoIP/vishing, automated OSINT, credential validation, CRM-style target management, infrastructure provisioning, and post-exploitation into a single platform represents a maturation of the PhaaS model. Ph1shy is not selling individual tools; it is selling a workflow. This lowers the bar for less technical operators while expanding the attack surface for defenders.

3. mTLS backend services are a new wrinkle. PHISHY-MAILER and PHISHY-CALLER indicate that Ph1shy's operator runs shared backend infrastructure for mail delivery and VoIP that customers connect to via mutual TLS. This is a service model, not just a software sale. It also creates a chokepoint that could be disrupted.

4. Njalla DNS remains a reliable malicious-intent signal. The use of Njalla nameservers for deepcoracert[.]com is consistent with findings from Push Security's ShinyHunters/BlackFile investigation. When you see Njalla DNS combined with self-signed certificates, no CT log presence, and ScreenConnect on port 443, treat it as a strong indicator.

5. The price drop tells a story. A 67% drop in panel price and 90% drop in source code price within four months suggests either market saturation in the post-Tycoon 2FA landscape or a shift toward volume-based distribution. Either way, more copies of this kit will be in the wild, and the infrastructure fingerprints documented here should make them findable.

---

11. Indicators of Compromise

Network Indicators, IP Addresses

Network Indicators, Domains

Network Indicators, Ports & Services

Actor Identifiers

Panel Artifacts

Panel Fingerprints (Source Code)

HTML / DOM Fingerprints

Historical IPs (Passive DNS)

---

Full infrastructure map and complete IOC list available on request.