PhishCase.

PHISHCASE / Documentation

PhishCase documentation

A practical guide to the first release. Use the repository runbooks for the exact configuration shipped with your version.

Deploy Community

Clone the public repository, prepare your environment, and start the Docker services. No default account or password is shipped.

git clone --branch feature/release-candidate-v1 https://github.com/CybersecSpirit/phishcase.git
cd phishcase
git checkout 1eaf0323ce0f4986a28e78dd066a609321f98d6f
cp .env.example .env
docker compose up -d --build
docker compose ps

Create the first administrator interactively, then open http://localhost:8088. Enable MFA from My account.

docker compose exec phishcase python -m backend.investigation.store

For a public deployment, terminate HTTPS at your reverse proxy and set COOKIE_SECURE=true. Keep service ports bound to loopback; do not expose the database.

Investigate an email

  1. Upload EML/MSG evidence. Batch intake accepts up to 20 files, with a 20 MB limit per email.
  2. The server preserves the original, creates a durable job and extracts indicators. Once upload finishes, analysis continues if the browser closes.
  3. Review sender identity, authentication headers and routing. Treat Authentication-Results as a claim unless you know the trusted relay boundary.
  4. Look at local results and shared indicators. Similarity is an explanation to investigate, not proof of a campaign.
  5. Save an analyst verdict with confidence and rationale. Reopening preserves the previous decisions.
  6. Export technical JSON, a readable HTML report or an evidence package. Downloads do not execute attachments.

Choose a connectivity policy

OfflineNo provider calls. Local analysis remains usable.
RestrictedLookups may be enabled with a configured provider. Files and URLs are never submitted.
ConnectedAllowed lookups and explicitly authorized submissions. Role checks and administrator policy still apply.

Configure VirusTotal and urlscan keys through deployment secrets. Verify your license permits your usage. VirusTotal uses standard APIs; it is not Private Scanning. urlscan submissions default to private, without silently falling back to public visibility.

Read provider configuration and limits →

Prepare Docker and Plesk

The initial target is one VPS with a Plesk HTTPS reverse proxy. Community uses its local persistent store. Cloud adds PostgreSQL, organization isolation and separate API/worker services. Public ports belong to the reverse proxy only.

Landingphishcase.cybertactic.fr
Applicationapp.phishcase.cybertactic.fr
Documentationdocs.phishcase.cybertactic.fr
  1. Configure DNS, obtain valid TLS certificates and redirect HTTP to HTTPS.
  2. Keep PostgreSQL and any queue services on a private Docker network. Publish app services only to loopback.
  3. Persist the database, immutable evidence and encryption keys. Set upload and reverse-proxy timeout limits deliberately.
  4. Run migrations before the new application version. Confirm /health and /ready, then test a synthetic upload through the public HTTPS route.

A local build is not a validated VPS deployment. Confirm healthy containers, proxy, HTTPS, worker completion, restart behavior and restore on the actual target.

Back up evidence and metadata together

Backups must cover database metadata, original evidence, attachments and stable encryption keys. Keep keys separate from publicly accessible files. Use a consistent database snapshot with the associated evidence volume.

  1. Schedule encrypted off-host backups and monitor their completion.
  2. Restore into a separate test environment with provider connectivity disabled.
  3. Apply the documented restore procedure for the same release, then verify counts, sample hashes, sign-in and case history.
  4. Record the tested recovery time and restore point. Never consider an untested archive a working recovery plan.

Cloud accounts, trial and billing

The Cloud specification is a 14-day trial without a card, limited to 30 analyses. Public signup requires email verification before a workspace is activated. Paid quotas cover analysts, monthly analyses and retention; upgrades must not destroy existing evidence.

Cloud rollout, transactional email, Stripe test events and production-domain checks require validation before the service is advertised as live. Never enter production payment secrets into the public site.

First-release scope and roadmap

Current focus: uploads, local analysis, cases, indicators, campaigns, human verdicts, optional enrichments, reports, Community and Cloud foundations.

Future: inbound reporting mailbox, Microsoft 365/Outlook and Gmail add-ins, advanced MISP/OpenCTI connectors, sandbox execution, multi-client MSSP features, high availability and object storage.

Read the versioned Community documentation →