Network Communication

LUCY may initiate or require certain communication channels to servers on the internet. Below is an overview of these requirements.

---

Outbound Communication

General Communication Types

1. First-Time Use: During the first installation, LUCY connects via HTTP to obtain the workstation key and ID. No data beyond the current build version is transmitted.

2. Updates: LUCY connects to our update server and Ubuntu repository mirror.

3. SSH: When SSH is enabled via the Help menu, LUCY initiates an outbound SSH connection to our SSH Jump Host. This feature is disabled by default.

4. Campaign Checks: LUCY connects to fixed servers to test campaign settings and internet reachability via HTTP/HTTPS. No data is transmitted during these tests.

5. Campaign Execution: LUCY may communicate via SMTP (Port 25 or 465) when sending emails over the internet.

6. Vulnerability Detection: To enable this feature, allow Port 80 access to static.nvd.nist.gov (129.6.13.177) for downloading the NIST CVE database.

Outbound Ports & IPs

IP Address/Domain	Function	Port	Protocol
162.55.130.83 (update.phishing-server.com)	Update/License Server, HTTP Proxy	80/443	TCP
162.55.130.83 (update.phishing-server.com)	Linux Repository	80	TCP
8.8.8.8 (or any DNS server)	DNS Server	53	UDP
nvd.nist.gov	NIST CVE Database (Optional)	443	TCP
0.0.0.0 (Any)	Mail Communication (Optional)	25	TCP
116.203.185.12 (changelog.lucysecurity.com)	Fetch Update News (Optional)	80	TCP
is.gd	URL Shortening Service (Optional)	443	TCP
api-ssl.bitly.com	URL Shortening Service (Optional)	443	TCP
api.authy.com	Two-Factor Authentication (Optional)	443	TCP

LUCY version ≥ 5.0 requires dynamic IP access to update1.phishing-server.com. Create an allow rule for the domain name.

---

Inbound Communication

To access LUCY from the internet, specific ports must be open:

Source IP	Destination	Port	Protocol	Comment
ANY	Your LUCY Server IP	80/443 (HTTP/HTTPS)	TCP	Required for accessing landing pages and certificate verification.
ANY	Your LUCY Server IP	25 (SMTP)	TCP	Only needed for catching email replies.

---

Malware Simulation Communication

The malware simulation tool uses the default browser (in hidden mode) to send collected data to LUCY via HTTP or HTTPS. For SSL-enabled campaigns, HTTPS is used automatically. The tool is compatible with environments requiring proxy authentication for internet access.