When the Rules of Engagement say the red team owns the full campaign chain, “we used a hosted simulation tool with third-party mail” stops being an answer.

Poseidon-X exists because campaign infrastructure has to survive scrutiny from the customer, compliance, and the operator who has to explain where every email came from. It started as a hardened GoPhish fork and grew into a multi-host platform: admin server, landing listener, file host, and SMTP host, each registered and managed as operator-controlled infrastructure.

The design constraint is sovereignty. Your IP reputation. Your DKIM. Your delivery path. Your audit trail. No third-party CDN, analytics, or telemetry calls are baked into the product. Outbound network activity is limited to operator-triggered flows with offline fallbacks, and operator actions land in an append-only audit log.

Wraith is the platform’s email authentication assessment layer — formerly a standalone project, now integrated into Poseidon-X. It inspects a domain’s MX, SPF, and DMARC records without sending mail, builds clearly labeled proof-of-concept messages, and preserves the evidence: generated .eml files, JSON result records, and full SMTP transcripts. By default, delivery attempts are dry-run; live direct-to-MX proofs require explicit operator confirmation and approved outbound access. Wraith Console provides passive DNS review, sender discovery, audience import, and campaign design through the same operator-facing stack as the rest of the platform.

The result is adversary-emulation infrastructure rather than a demo stack: campaign management, per-recipient tracking modes, deliverability preflight, email auth assessment, React analytics, and pure-Go reports for engagements where the paperwork matters.

cat redacted-results.log sanitized logs

Credential campaign QA

redacted campaign flow

The QA path validates delivery, landing behavior, audit state, and live operator updates.

sanitized-output
campaign: PX-QA-[REDACTED]
mode: email + credential landing
preflight:
  spam_score: pass
  dns_auth: pass
  file_host: not_required
events:
  email_sent: ok
  click_tracked: ok
  credential_submit: ok
  audit_row: ok
  sse_update: ok

Host registration state

redacted dashboard

Campaign infrastructure is modeled as registered operator-owned hosts, not vendor services.

sanitized-output
admin      https://admin.[REDACTED]      healthy
landing    https://login.[REDACTED]      listener online / drain connected
files      https://dl.[REDACTED]         caddy online
smtp       smtp.[REDACTED]:587           dkim aligned / relay ready
telemetry  third_party                   disabled

DNS posture snapshot

redacted JSON

Wraith's read-only DNS recon captures MX, SPF, DMARC, and related records as structured evidence before any delivery attempt.

sanitized-output
domain: client-[REDACTED].com
mx:
  - priority: 10
    host: aspmx.l.google.com
spf: "v=spf1 include:_spf.google.com ~all"
dmarc: absent
ns: [cloudflare, cloudflare]
saved: ~/.wraith/evidence/dns_client_[REDACTED]_com.json

Console launch manifest

redacted dry-run record

The assessment console defaults to dry-run. Live delivery requires operator review and explicit confirmation.

sanitized-output
campaign: authorized-poc-[REDACTED]
mode: dry_run
from: security-test@client-[REDACTED].com
to: approved-recipient@client-[REDACTED].com
mx_target: aspmx.l.google.com
hunter_senders: 3
auth_notice: appended
evidence_dir: ~/.wraith/evidence/[REDACTED]/