This question is, in part, “How do I get my phishing emails past spam detection?” Answering that isn't really in our best interest and you shouldn't spend too much time on it. Instead, get your sending server whitelisted locally so your test is not run through any spam filters.
The easiest solution is to use a well-known testing agency like Cofense PhishMe, Wombat, or KnowBe4, and they'll do the heavy lifting and walk you through the rest. This may not be ideal if you have a really small budget and/or if this is part of a student project.
A good in-house phishing test must
- Approval from an executive or director, not just IT or Engineering
- Relevant infosec and netops teams should sign off on this test
Use external servers:
- Send the test from an external IP address range
- Bypass anti-spam scanning by whitelisting the test's sending IP(s)
Identify itself as a phishing test in its headers:
- Add an
X-PHISHTEST header with your contact info for escalations
- Leaving this indicator allows security groups to safely ignore reports
X-PHISHTEST header triggers a “phishing attack” verdict in some spam detection solutions and prevents the “free pass” for reported phishing reports from meddling with real attack detection. Note the need for whitelisting above.
Have a good landing site:
- Consider a vanity domain like
- Embed each user address in the link's query string
- Log users' clicks and the IPs they clicked from for your report
- Tell users that they fell for your trap and educate them
- Link or host content similar to the APWG's Stop.Think.Connect.
- Reveal the test at the document root or without a query string
so security researchers can understand your intent
Bad phishing tests
- Will get into trouble with testers' management
- Can get larger accounts suspended
- Might get caught as spam and therefore fail to reach the targets
- Risk annoying yet not educating the user base
- Will confuse anti-spam filters when trained as phishing
Answers to your specific questions
Where do I host this site and how do I send this email?
So long as you follow the above rules about a good test and a good landing site, you shouldn't run into problems. As noted above, it is a good idea to alert your network operators (this includes your web hosting company) before you conduct this test.
I've seen some free hosting sites. Do email providers give low reputation to such free hosting sites?
You're probably referring to spam detection systems, which are nowadays extraordinarily complex, pulling in as much metadata as possible and combining it all with lots of secret sauce and machine learning. You really want to bypass spam detection with whitelisting. Client-side anti-spam is rarely powerful enough to discriminate in the manner you're worrying about.
Also, for sending the email, should I choose popular email service providers like gmail, hotmail or should I use disposable email? What will increase the chances of the email reaching the users?
Again, you need to bypass anti-spam, at which point much of this doesn't matter. A cheap vanity domain like
<institution>-support.com likely comes with the ability to send within your provider's hosted environment.
I consider GMail and Hotmail to be disposable. Many penetration tests register accounts like
<institution>-firstname.lastname@example.org and use good friendly from names like
<institution> Support (which is the only thing mobile email clients display).