search

gophish / gophish

Open-Source Phishing Toolkit
https://getgophish.com
Other
11.29k stars 2.19k forks source link

"Email Opened" detection not working #3086

Open ring-gt-ken opened 8 months ago

ring-gt-ken commented 8 months ago

Thanks for reaching out! We're happy to help resolve issues as quickly as possible.

Please use this template when creating a new issue. If you do not follow this template format, your issue may be closed without comment.

Before filing a new issue, please use the search bar at the top of the browser to search for similar issues. Also, please make sure you have read our documentation, which covers how to use Gophish.

What version of Gophish are you using?: 12.1

Brief description of the issue: "Email Opened" detection not working consistently, or at all. We have a prod and dev server for gophish, for the dev server the "Email Opened" is counted even if the actual email is not opened. For the prod, it is only counted when the user clicks the link.

What are you expecting to see happen? : For the "Email Opened" to increment when the user actually opens the email, and not on any other situations.

What are you seeing happen? Here is the issue in our dev environment. The Email Opened counter is immediately incremented 4 seconds after it is being sent:

image

However, the email is still not opened and is unread in the actual mailbox. We are using Google workspace.

image

For the prod environment, the issue is different. The "Email Opened" counter is not incremented when you open the email, only when the user clicks the link.

Please provide as many steps as you can to reproduce the problem: Just a basic landing page, basic email template, and no tracking image attached. Recipient is a goggle workspace hosted email domain.

ring-gt-ken commented 8 months ago

Here is the issue on the prod. No detection for Email Opened, straight to when user clicks the link.

image

acfranken commented 6 months ago

If the end user does not load images automatically in their email client (e.g. Outlook), the tracker pixel is not loaded and as such it cannot be measured that the phishing email was opened. Therefore it goes straight to 'clicked'.

acfranken commented 6 months ago

In regards to your first question, some large email providers (also depending on the exact configuration and licenses a company have) scan emails on suspicious links, images, attachments etc. Therefore, if the tracker pixel is loaded by such scanning, it is immediately tracked in GoPhish as 'email opened' almost at the same time as 'email sent'. This is not something GoPhish can fix of course.