Gophish - Setting up without Evilginx - Part 1

Gophish Infrastructure Setup (EC2 · DNS · SMTP)

This section covers the infrastructure-level setup required before deploying GoPhish. Proper configuration at this stage is critical to avoid blacklisting, delivery issues, and operational failures during phishing simulations.

Prerequisites

---

Before starting the setup, ensure the following requirements are met:

• EC2 instance (Linux-based preferred)
• Phishing domain (e.g., Namecheap or GoDaddy)
• SMTP server associated with the same domain
  (e.g., Titan Mail, Private Email, etc.)

EC2 Configuration

---

Note: Never expose GoPhish or phishing infrastructure publicly without restrictions. Improper exposure can quickly lead to blacklisting or service suspension.

Recommended EC2 configuration:

• Whitelist trusted IP addresses instead of allowing unrestricted access (0.0.0.0/0)

• Be cautious of automated scanners and reputation monitoring platforms such as:

  • Spam-Eating Monkey
  • Censys Threat Hunting Dataset

• Ensure port 443 (HTTPS) remains open
  Blocking HTTPS can break landing pages, redirects, and certificate validation.

• Allow only the required ports:

  • 22 → SSH (restricted to your IP)
  • 80 → HTTP (optional, for redirects or ACME challenges)
  • 443 → HTTPS (phishing landing pages)
  • One custom port (e.g., 3333) for the GoPhish admin dashboard

• After infrastructure setup:

  • Apply strict IP whitelisting to the admin dashboard port
  • Never leave the GoPhish admin panel publicly accessible

Domain Configuration

---

Correct DNS configuration is essential for email deliverability and phishing reliability.

• Map the A record to your AWS EC2 public IP

• Properly configure the following DNS records:

  • SPF
  • DMARC
  • DKIM
  • TXT
  • SRV (if required by your SMTP provider)

• Create two CNAME records:

  • One for the GoPhish admin dashboard
  • One for the phishing domain / landing page

SMTP Configuration

---

SMTP configuration directly impacts campaign success and inbox placement.

Best practices:

• Ensure DKIM is added and successfully verified
• Use multiple SMTP servers if possible to distribute sending load
• Prefer a paid or premium SMTP plan for:
  • Better deliverability
  • Reduced throttling
  • Improved sender reputation

Compliance and Operational Notes

Awareness: Reputation & Threat Monitoring Services

---

⚠️ Certain platforms actively monitor spam and phishing-related infrastructure. Poor OPSEC may result in rapid blacklisting.

Be aware of:

• Spam-Eating Monkey
• Censys Threat Hunting Dataset

AWS Permission Requirement

---

Before launching any phishing or social engineering campaign, explicit authorization must be obtained from AWS.

Failure to comply may result in account suspension or termination.

• AWS Penetration Testing Policy:
  https://aws.amazon.com/security/penetration-testing/

Next Section

---

Part II - GoPhish Setup
Campaign creation, landing pages, email templates, and credential capture