here are config files for using *[.]azurewebsites[.]net domain for phishing.

infrastructure setup:

azure function → nginx redirector → target framework (e.g. gophish)

the nginx redirector with the target framework stays hidden behind the azure function.

• /azurefunction: folder for azure function deployment
• /azurefunction/OwaCheckIn: endpoint files for phishin
• /azurefunction/OwaCheckIn_track: endpoint files for tracking email opening (for gophish)
• /nginx: nginx configuration
• /nginx/sites-available/phish.conf: nginx redirector accepting azurefunction and forwarding to local (gophish) framework

with Azure Functions Core Tools.

local testing:

func start

deployment to prod with app name evil (after logging in with az login):

func azure functionapp publish evil

Microsoft 365 Business Basic for $5.00 user / month. :) Free or trial may cause issues, it won't work as expected.

using is allowed only for educational and/or research purposes!

unauthorized phishing is prohibited.