Welcome to our phishing simulation platform. This guide provides a clear and practical overview of the product’s main features and explains how to design and launch a complete phishing simulation campaign, from preparation to reporting.
This platform is a phishing simulation framework designed to make attack testing realistic and accessible. Built on an open-source foundation, it features an improved user interface and enterprise-ready infrastructure: scenario creation, target management, SMTP delivery, directory integrations, and automated results tracking.
To use the platform, you need:
If you have external antispam protections, whitelist the recommended sending IP addresses (e.g., 185.163.125.9, 45.13.104.11).
After your account is created, open a browser and go to: https://<your-subdomain>.yourplatform.com. Credentials (username and password) are provided by email at onboarding.
The Account & Settings panel centralizes the instance configuration: language, API key management (can be reset), and access to documentation. To change your password, go to Manage your account.
Two billing models exist:
The organization dashboard shows quota usage and target consumption. MSSPs can enable license sharing between clients.
For MSSPs, the Clients section lets you add and manage customers (logo, billing type, domains, quotas). You can also add phishing domains:
The Phishing DNS Toolkit suggests domain names suitable for phishing simulations.
Admins can create user accounts with distinct credentials, enabling delegation of campaign operations and separation of responsibilities.
Available integration types:
Click Install to enable Microsoft user integration. A modal will let you enable user/group sync, then you’ll be redirected to Microsoft for authorizations.
Enable Google integration by creating an application in the Google Admin Console and entering the clientId and required scopes into the platform, then install.
Webhooks provide real‑time campaign events (same JSON structure as the API). They can be signed and are created by administrators via the Webhooks section.
Domain management centralizes the names used for landing pages. You can buy new domains, add them, verify DNS records, and decide whether domains are shared or dedicated per client.
Configure how results are collected and displayed, including enabling IMAP sync to retrieve responses or bounces from a mailbox to improve report accuracy.
The Employees & Groups section lets you import, create, and organize targets (emails, names, attributes). Use directory sync or CSV import to bulk add targets.
Environments represent the phishing themes or personas used in simulations — the user‑facing context and look‑and‑feel of the attack rather than low‑level infrastructure. An environment bundles the sender profile, visible UI template, wording style, and landing‑page design that together create a believable lure.
Examples:
Create one environment per phishing theme so you can reuse templates, sender addresses, and landing pages across multiple campaigns while keeping consistency and realism.
For your environment, you can create landing pages either by using the proxy to generate them with AI or by creating the template yourself using the “Clone” option.
A scenario defines the email content (subject, sender, HTML/MJML template), linked landing page, redirections, and tracking rules. Scenarios can include variants and may leverage AI to generate templates.
You can add your scenarios to the catalog globally so that you can share and reuse them.
A campaign ties a target group to one or more scenarios and an environment, schedules sends, and tracks outcomes (clicks, submissions, opens). Clone or schedule campaigns and monitor their status in real time.
The Reporting section collects all events: clicks, IPs, geolocation, target status, etc. IMAP sync enables fetching replies and bounces from a mailbox to improve report accuracy.
The dashboard gives an overview of activity: recent campaigns, success rates, at‑risk targets, and key metrics to drive your awareness program.
This chapter walks through creating a full campaign step‑by‑step.
A step‑by‑step example that demonstrates creating a client, importing groups, designing a landing page, setting up an environment, and launching a campaign.
Use CSV import or directory sync to populate your target database.
Create or import the HTML destination page used after a click. Test locally and verify tracking.
Choose or create the environment (theme/persona) for this campaign. Assign sender profiles and landing‑page styles.
Select an email template, subject, sender, and link the landing page and environment. Configure variables (e.g., {{.FirstName}}) and enable AI variants if desired.
Tip: Remember — templates are case sensitive.
| Variable | Description |
|---|---|
{{.RId}} |
L’identifiant unique de la cible |
{{.RIdBasic}} |
Variante simplifiée de l’identifiant unique (sans encodage spécial, utile pour logs ou URLs custom) |
{{.FirstName}} |
Prénom de la cible |
{{.LastName}} |
Nom de la cible |
{{.Position}} |
Poste / fonction de la cible |
{{.Email}} |
Adresse e-mail de la cible |
{{.From}} |
Expéditeur usurpé affiché dans l’e-mail |
{{.URL}} |
URL phishing principale |
{{.BaseURL}} |
URL de base sans paramètres ni path (utile pour pointer vers des ressources statiques) |
{{.TrackingURL}} |
URL du tracker utilisé pour l’ouverture de l’e-mail |
{{.Tracker}} |
Alias pour intégrer l’image de tracking : <img src="{{.TrackingURL}}"/> |
{{.TrackerAttachment}} |
Nom ou chemin de la pièce jointe tracker (si utilisé) |
{{.DetailsLastScenarioService}} |
Informations détaillées sur le dernier scénario/service utilisé (ex. pour scénarios en chaîne) |
{{.LogoServiceUsed}} |
Nom du service dont le logo doit être affiché (ex. “Microsoft”, “Google”) |
{{.GTPService}} |
Nom du service associé au scénario GTP (selon votre logique interne) |
Champs hérités de BaseRecipient |
(déjà listés ci-dessus : FirstName, LastName, Position, Email, etc.) |
Schedule send time and monitor progress from the dashboard. Use reports and webhooks to collect events in real time.