¶ User guide for launching campaigns
¶ Introduction
Welcome to our phishing simulation platform. This guide provides a clear and practical overview of the product’s main features and explains how to design and launch a complete phishing simulation campaign, from preparation to reporting.
¶ What is This Phishing Simulation Platform?
This platform is a phishing simulation framework designed to make attack testing realistic and accessible. Built on an open-source foundation, it features an improved user interface and enterprise-ready infrastructure: scenario creation, target management, SMTP delivery, directory integrations, and automated results tracking.
¶ Requirements
To use the platform, you need:
- An account / access provided by your service provider.
- Internet access to reach the web UI and API.
- A basic understanding of phishing and your campaign objectives.
If you have external antispam protections, whitelist the recommended sending IP addresses (e.g., 185.163.125.9, 45.13.104.11).
Domain: whitelisting.gottaphish.com
¶ Getting Started
After your account is created, open a browser and go to: https://<your-subdomain>.yourplatform.com. Credentials (username and password) are provided by email at onboarding.
¶ Account & Settings
¶ General Account
The Account & Settings panel centralizes the instance configuration: language, API key management (can be reset), and access to documentation. To change your password, go to Manage your account.
¶ Organization
Two billing models exist:
- Billing per number of sent emails.
- Billing per number of targets (a target can receive unlimited emails).
The organization dashboard shows quota usage and target consumption. MSSPs can enable license sharing between clients.
¶ Clients
For MSSPs, the Clients section lets you add and manage customers (logo, billing type, domains, quotas). You can also add phishing domains:
- Click New Domain.
- Add the provided TXT entry in your registrar’s DNS.
- Once validated, the domain becomes available.
The Phishing DNS Toolkit suggests domain names suitable for phishing simulations.
¶ Users
Admins can create user accounts with distinct credentials, enabling delegation of campaign operations and separation of responsibilities.
¶ Integrations
Available integration types:
- Direct Message Injection (DMI) — send emails directly via Microsoft or Google APIs.
- User Sync — automatically import accounts and groups from Google Workspace or Microsoft 365.
- Basic SMTP — send emails via your SMTP server.
- Moodle — redirect compromised users to awareness training modules.
¶ Microsoft
Click Install to enable Microsoft user integration. A modal will let you enable user/group sync, then you’ll be redirected to Microsoft for authorizations.
To whitelist SMTP with MS you can do it via : https://security.microsoft.com/advanceddelivery?viewid=PhishingSimulation
Enable Google integration by creating an application in the Google Admin Console and entering the clientId and required scopes into the platform, then install.
¶ Webhooks
Webhooks provide real‑time campaign events (same JSON structure as the API). They can be signed and are created by administrators via the Webhooks section.
¶ Domains and DNS
Domain management centralizes the names used for landing pages. You can buy new domains, add them, verify DNS records, and decide whether domains are shared or dedicated per client.
¶ Reporting Settings
Configure how results are collected and displayed, including enabling IMAP sync to retrieve responses or bounces from a mailbox to improve report accuracy.
¶ Create a campaign
Complete these steps to launch your campaigns.
¶ Before you begin
In the “Client Settings” section, under the “License Management” tab, check that you have the number of licenses required to launch your campaign. You can purchase licenses at any time by clicking on the “Order Licenses” button.
¶ Create your landing page
In order to best capture your targets, you must create or import the landing pages to which people who click on the link in your campaign email will be redirected.
From the “Environments” section, “Landing Pages” tab, click on “New Landing Page.”
You can then choose between two types of pages:
- Dynamic Page: Paste the URL of the page to which you want to redirect your campaign's victims, and name it.
- Static page: After pasting the URL of the page of your choice, you can modify it freely. For the more creative among you, it is also possible to create your own landing page from scratch.
¶ Define your environment
Environments represent the phishing themes or personas used in simulations — the user‑facing context and look‑and‑feel of the attack rather than low‑level infrastructure. An environment bundles the sender profile, visible UI template, wording style, and landing‑page design that together create a believable lure.
Examples:
- Outlook — corporate email appearance and wording that mimics Microsoft/Outlook interfaces.
- Gmail — consumer email appearance, Google branding and phrasing.
- Event‑themed — special lures like "Paris Olympics" (Jo de Paris), vendor notices, HR announcements, etc.
Create one environment per phishing theme so you can reuse templates, sender addresses, and landing pages across multiple campaigns while keeping consistency and realism.
In the “Environments” section, define the company whose identity you want to spoof so that it appears as the sender of your campaign emails.
In the advanced settings, you can define
Enter its name, select or import its logo, then associate the corresponding landing page.
Also specify the domain name that will be displayed as the sender of the emails.
You can purchase new domains at any time in the “Integrations” section, under the “Domains” tab.
By default, two scenarios are automatically created for each environment. You can choose to generate 0, 1, or 2 additional scenarios per day, so you have ready-to-use scenarios for your next campaigns.
¶ Create your scenario
In the “Scenarios” section, create the emails that your targets will receive in their inbox.
Here you will find all your email templates, as well as those shared by the community.
- Click on “New scenario” to create your phishing email.
- Select the associated environment.
- Set the number of emails to generate for this environment.
- You can specify a specific target group. The emails will then be generated based on this group.
*Example: if you target the HR group, the emails may cover topics related to leave, job applications, or fake job openings. - Choose the email format (HTML, MJML, or SMS) and language.
- Finally, write a prompt for our AI. You can specify the type of email you want, its subject, content, terms to include, the type of reaction you want to elicit from the target, etc.
Then click on create, and your email will appear in a few seconds.
Modify your email templates
By hovering over the email, you can add it to the catalog, edit it, or delete it.
By clicking on edit, you can change the name of the scenario and its description, but above all, you can access advanced customization settings.
You can also manually modify the content of the email (change a word, add a sentence, etc.), either via the visual editor or via the code editor, symbolized by this icon:
- The “Catalog” button, located at the top right, provides access to a library of phishing emails shared by the community.
The “Verified by GottaPhish” filter groups together emails that have been tested, validated, and approved by our teams.
¶ Template Reference
Tip: Remember — templates are case sensitive.
| Variable | Description |
|---|---|
{{.RId}} |
L’identifiant unique de la cible |
{{.RIdBasic}} |
Variante simplifiée de l’identifiant unique (sans encodage spécial, utile pour logs ou URLs custom) |
{{.FirstName}} |
Prénom de la cible |
{{.LastName}} |
Nom de la cible |
{{.Position}} |
Poste / fonction de la cible |
{{.Email}} |
Adresse e-mail de la cible |
{{.From}} |
Expéditeur usurpé affiché dans l’e-mail |
{{.URL}} |
URL phishing principale |
{{.BaseURL}} |
URL de base sans paramètres ni path (utile pour pointer vers des ressources statiques) |
{{.TrackingURL}} |
URL du tracker utilisé pour l’ouverture de l’e-mail |
{{.Tracker}} |
Alias pour intégrer l’image de tracking : <img src="{{.TrackingURL}}"/> |
{{.TrackerAttachment}} |
Nom ou chemin de la pièce jointe tracker (si utilisé) |
{{.DetailsLastScenarioService}} |
Informations détaillées sur le dernier scénario/service utilisé (ex. pour scénarios en chaîne) |
{{.LogoServiceUsed}} |
Nom du service dont le logo doit être affiché (ex. “Microsoft”, “Google”) |
{{.GTPService}} |
Nom du service associé au scénario GTP (selon votre logique interne) |
Champs hérités de BaseRecipient |
(déjà listés ci-dessus : FirstName, LastName, Position, Email, etc.) |
¶ Group your targets
In the “Employees & Groups” section, create your groups by importing your employees.
Several methods are available:
- manual addition,
- CSV file import,
- smart creation via AI, based on the results of your previous campaigns
*Examples: create a group with all employees who have never clicked on a phishing email, or, conversely, a group with all repeat offenders.
You can also add an employee from the “Employees” tab and associate tags with them to refine the personalization.
¶ Launch your campaign
In the “Campaigns” section, you will find your campaign history, with results for each campaign such as the number of emails opened, links clicked, and emails reported.
To launch your first campaign, click on “New Campaign.”
You can then:
- give it a name,
- select the target group,
- schedule its delivery,
- choose the scenarios to play during the campaign.
Once the campaign is over, you can close it by sending an educational email using the green button to the left of each campaign.
This email explains to recipients that it was a phishing email and details the signs to look out for to avoid being caught out in the future.
¶ Reporting & IMAP sync
The Reporting section collects all events: clicks, IPs, geolocation, target status, etc. IMAP sync enables fetching replies and bounces from a mailbox to improve report accuracy.
¶ Dashboard
The dashboard gives an overview of activity: recent campaigns, success rates, at‑risk targets, and key metrics to drive your awareness program.
