Gophish: Who is using GoPhish? (Companies)

[skeltontom]

Hi all,

Does anyone have information on which companies are using GoPhish currently? I've been tasked at work to investigate if any larger scale companies are using GoPhish, and if so, who they are.

Any help / guidance would be much appreciated :+1:

[S0larflare]

Can’t give anything specific, but my company is a large utility company and we have been using GoPhish for several years

Sent from my iPhone

On 12 Nov 2019, at 13:21, skeltontom [e-mail] wrote:



Hi all,

Does anyone have information on which companies are using GoPhish currently? I've been tasked at work to investigate if any larger scale companies are using GoPhish, and if so, who they are.

Any help / guidance would be much appreciated 👍

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHubhttps://github.com/gophish/gophish/issues/1658?email_source=notifications&email_token=ACEGR3L5JJ3A5TDYQRQYK5DQTKUVFA5CNFSM4JMDMZE2YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4HYWFTLA, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ACEGR3NER7PR4W6SN3MVXZTQTKUVFANCNFSM4JMDMZEQ.

[jordan-wright]

I'd be interested in the responses to this issue, so I'll keep it up for a few days. 😄

A key thing to know is that I have 0 tracking on Gophish, beyond Google Analytics and Cloudflare metrics on the https://getgophish.com website. This means I never know how widely Gophish is used, and instead resort to much more relative metrics, like Github download counts, stars, etc.

What I will say is that anecdotally I've definitely heard of many companies using Gophish. This ranges from organizations using it internally, consultants using it for paid phishing engagements, and red teams using it to kick off offensive engagements. The organizations range across the spectrum of education, finance, government, tech, etc. They range from SMBs to large enterprises (just look through the issues for UI slowness issues, and you'll find campaigns run with thousands of users 😛).

Beyond just using Gophish, one thing that I love is that many of these people are regularly here in the issues, helping out others, offering feature ideas, or submitting pull requests. @S0larflare is a perfect example of the type of people that help make this community so great!

[aczietlow]

Like above I can't give specifics but we're using gophish across 100s of SMBs and some large enterprise users all from within a single instance. We're currently running ~3k campaigns with ~150k users.

[franckyz0r]

Have faith in it, it works!

Proud user of GoPhish in campaigns with ~3k users.

Hi all,

Does anyone have information on which companies are using GoPhish currently? I've been tasked at work to investigate if any larger scale companies are using GoPhish, and if so, who they are.

Any help / guidance would be much appreciated 👍

[Eviepayne]

I do system and security engineering for a third party IT company. I'm using gophish as a product to test phishing awareness at approx. 50 companies averaging 50-80 employees.
gophish is dope.

[glennzw]

It could be an option to add an opt-in anonymous tracker to gophish. On first execution the user would be prompted as to whether they wanted to participate or not, and you have a listener on gophish.com - either just checking in that the software is running, or more detailed (e.g number of users/campaigns run). All non identifiable and anonymous and opt in of course.

Or maybe just a optional survey form on the download page.

[TheGroundZero]

I've used it in a Big Four company both for internal assessments as with clients in the past.

I believe they've since however moved to a commercial product.

[pookiecat]

Can’t give anything specific, but my company is a large utility company and we have been using GoPhish for several years
…

With your experience, may I ask for advice re sizing ~
with regular campaigns of up to 10k users - whether you think a VM instance of B2MS with 2 Cores, 8 GB Ram, 16 GB temp storage and Standard SSD (E4:32 Gib disk size) is reasonable to start with?

[pookiecat]

Like above I can't give specifics but we're using gophish across 100s of SMBs and some large enterprise users all from within a single instance. We're currently running ~3k campaigns with ~150k users.

Would you mind sharing what's the VM requirement you have currently for 3k campaigns running smoothly?

[jordan-wright]

Thanks for all the feedback y'all! I originally only wanted this to be up for a few days and wound up leaving it open a bit longer.

I figure it's been long enough that I can close it out 😄

[edermi]

Just to drop a few numbers because I took a closer look today:
~4k Users on a dual core VPC. Sending all mails took about 90 seconds, RAM usage stays < 512MB. The system also hosts the mail server and a reverse proxy that delivers images and videos explaining phishing and how to detect phishing after a user fell for it, so it is not "just" GoPhish.

From my intuition, the most performance critical part is querying the database, therefore preferring MySQL over SQLite would be the first thing to try in order to improve performance, but I have no numbers to prove this theory yet.