Comparisons
Phishing Club vs Gophish vs Evilginx
✓ Available ✓* Partial PRO Evilginx PRO only ✗ Not available
| Feature | Phishing Club | Gophish | Evilginx | Notes |
|---|---|---|---|---|
| Overall | ||||
| Phishing simulation | ✓ | ✓ | ✗ | |
| AiTM proxy phishing | ✓ | ✗ | ✓ | |
| Remote Browser Phishing via CDP | ✓ | ✗ | PRO | |
| Device code phishing | ✓ | ✗ | ✗ | Phishing Club supports Microsoft Device Code phishing |
| AiTM Proxy | ||||
| Credential and session capture | ✓ | ✗ | ✓ | |
| YAML proxy config | ✓ | ✗ | ✓ | |
| Visual proxy builder | ✓ | ✗ | ✗ | Evilginx is configured exclusively via YAML phishlets |
| DOM, regex and header rewrites | ✓ | ✗ | PRO | |
| URL and query param rewriting | ✓ | ✗ | PRO | Masks suspicious paths and renames query parameters. |
| Multiple capture engines | ✓ | ✗ | PRO | |
| Pre-built phishlets | ✗ | ✗ | PRO | |
| Upstream proxy support | ✓ | ✗ | ✓ | Forward traffic through an upstream proxy for debugging or additional interception |
| Dynamic proxy support | ✓ | ✗ | ✗ | Select upstream proxy based on self defined logic |
| Campaign Management | ||||
| SMTP delivery | ✓ | ✓ | ✗ | |
| API delivery | ✓ | ✗ | ✗ | Add custom HTTP endpoint with configurable method, headers, payload and response validation |
| OAuth provider integration | ✓ | ✗ | ✗ | Connect OAuth 2.0 provider for API delivery. Import captured refresh tokens from Session Sushi |
| Recipient management | ✓ | ✓ | ✗ | |
| Per-recipient tracking | ✓ | ✓ | ✓ | Evilginx can create multiple lure links for individual tracking |
| Dynamic recipient groups | ✓ | ✗ | ✗ | Auto updating groups filtered by department, city, country and more |
| Multiple pages per campaign | ✓ | ✗ | ✗ | Before page, landing page and after page in one reusable template |
| Campaign scheduling | ✓ | ✓ | ✗ | Phishing Club has time box and daily slot scheduling with weekday and hour restrictions |
| Custom send distribution | ✓ | ✗ | ✗ | Phishing Club can sort, randomize and add jitter to send distribution. |
| Analytics dashboard | ✓ | ✓ | ✗ | |
| Anonymization | ✓ | ✗ | ✗ | |
| Multi-tenancy | ✓ | ✗ | ✗ | |
| Awareness training campaigns | ✓ | ✗ | ✗ | Deliver a lesson instead of capturing credentials. Records training started and completed, kept separate from phishing risk, with dedicated reports |
| Evasion and Filtering | ||||
| IP, ASN and CIDR filtering | ✓ | ✗ | ✓* | Phishing Club supports CIDR ranges, ASN and geo IP. Evilginx has basic IP blocking |
| JA4 TLS fingerprint filtering | ✓ | ✗ | PRO | |
| HTTP header filtering | ✓ | ✗ | PRO | Evilginx PRO has buildin user agents allow listing / deny listing |
| Evasion pages | ✓ | ✗ | ✗ | Host clean content to automated visitors, phishing page to real recipients |
| HTML obfuscation | ✓ | ✗ | PRO | Dynamically rewrites page output on each request |
| Built-in bot guard | ✗ | ✗ | PRO | Evilginx PRO provides a managed bot guard. Phishing Club gives you full control to configure your own custom evasion page, filters and deny pages |
| Editor | ||||
| Code editor | ✓ | ✓* | ✗ | Phishing Club uses Monaco (VS Code editor). Gophish uses a WYSIWYG editor |
| Live preview | ✓ | ✓* | ✗ | Phishing Club preview supports variable substitution and domain switching |
| Clone website | ✗ | ✓ | ✗ | Gophish can import and clone simple static websites |
| Administration | ||||
| Web-based admin panel | ✓ | ✓ | ✗ | Evilginx is CLI-based |
| Asset management | ✓ | ✗ | ✗ | Web UI for per-domain and shared file hosting with priority resolution. |
| Multi-user | ✓ | ✓ | ✗ | |
| Automatic TLS per domain | ✓ | ✗ | ✓ | Let's Encrypt, self-signed or self supplied |
| Windows support | ✗ | ✓ | ✓ | Phishing Club does not officially support Windows |
| Open source | ✓ | ✓ | ✓* | Phishing Club: AGPL v3. Gophish: MIT. Evilginx v2: MIT. Evilginx v3+: commercial |
| Security | ||||
| MFA (TOTP) | ✓ | ✗ | PRO | |
| SSO (Microsoft Entra and OIDC) | ✓ | ✗ | ✗ | |
| Admin IP allowlist | ✓ | ✗ | ✗ | |