Monitor a live phishing campaign

Read the campaign detail page — engagement stats, delivery details, the enrolled-users table — and know when to refresh versus when stats are degraded.

After you launch a simulation, the campaign detail page is where you watch it play out: how many emails went out, how many people opened, clicked, or reported, and which delivery window is in effect. You'll use this page in the hours and days after a launch to track engagement, and again later when you need to pull a specific recipient's activity before assigning follow-up training. This article walks through every part of the page and explains when the numbers are live, when they're a local fallback, and what the contextual banner is telling you.

Before you start

Prerequisites

You're signed in to Hook as an org admin, with the right organization selected in the org switcher if you manage more than one.
You've launched at least one campaign. If you haven't, start with Run a phishing campaign.

Open the campaign detail page

From the left nav, go to Phishing to reach the campaigns list at /org/phishing. The list has status filters across the top — All, Active, Scheduled, Completed, and Failed — followed by a paged list of campaigns.

Filters count the visible campaign set

The filter counts reflect the campaigns available in the current org context. Use Refresh if you just launched a campaign and need the list to pull the latest status.

Click any row in the table to open its detail page at /org/phishing/<campaign-id>. You also land here automatically right after launching a new campaign.

Phishing campaigns list with status filters and campaign rows

Read the engagement funnel

An engagement funnel sits under the campaign header and delivery banner:

Card	What it counts	Source
Enrolled	Recipients attached to the campaign	Recipient count
Sent	Messages dispatched	Messages
Opened	Unique users who opened the email	Live (PhishingBox)
Clicked	Unique users who clicked the link	Live (PhishingBox)
Reported	Unique users who reported the email	Live (PhishingBox)

Opened, Clicked, and Reported are unique-user counts — one person who opens an email five times still counts once. These three are pulled live from PhishingBox each time the page loads. Enrolled and Sent are drawn from the campaign record and the provider's send totals.

Campaign detail engagement funnel with Enrolled, Sent, Opened, Clicked, and Reported counts

Read the contextual banner

Near the delivery progress and funnel, Hook shows a single alert that changes based on the campaign's state. You'll see exactly one of these:

Failed-sync warning (red). This campaign failed to sync. You can create a new campaign to try again. The simulation never reached the delivery provider — see Common pitfalls below.
Scheduled / drip callout. When the campaign uses a spread-out delivery schedule rather than sending immediately, the banner explains that emails are queued according to that schedule, so recipients may not receive them right away.
Provider stats temporarily unavailable. Provider statistics are temporarily unavailable. Refresh will retry the live report fetch. Hook reached the provider but couldn't load the live report this time. Your stats are showing local fallback values.
Default live-stats note. Live engagement statistics are pulled from PhishingBox. Use Refresh to check for updates. The normal, healthy state.

Campaign detail page with the delivery progress card and provider-statistics banner

Read campaign details

Below the recipient activity table, expand Campaign details to see how the campaign was set up and how it's being delivered.

Campaign setup

Launch details and template selection: Type, Template (or — if none), Start Date, and Created timestamp.

Delivery record

Audience and provider tracking context: Status, Recipients (the total enrolled count), Audience, and Provider ID.

Audience currently reads the literal text Configured at launch — the recipient mode isn't stored on the campaign yet, so this field doesn't display who was targeted. Either way, your targeting was locked in when you launched and isn't re-editable here.
Provider ID is the upstream PhishingBox campaign identifier. It reads Pending until the campaign finishes syncing to the provider.

Delivery

How and when emails go out: Mode, Sending, and Tracking.

For an immediate campaign, Mode reads At campaign start, Sending shows the hourly rate cap (for example, Up to 1,000 emails/hour), and Tracking states how long clicks and reports are tracked (default 3 days).
For a scheduled campaign, Mode reads Spread over N days, Sending shows the business-hours window (for example, Mon-Fri, 8:00 AM-5:00 PM), and Tracking again states the tracking window.

Expanded Campaign details panel with setup, delivery, tracking, and provider fields

Read the recipient activity table

The Recipient activity card lists individual recipients with Name, Email, and an Activity badge per row. A N total badge in the card header shows the full recipient count.

Activity reflects the furthest action each recipient took — Reported, Clicked, Opened, Sent, or Targeted when live provider data is available, or Enrolled for every row in the local fallback list.

The list can be partial

When live provider data is available, Hook loads the campaign's recipients from PhishingBox in pages. If a page can't be fetched, the table shows the rows it did load and a Showing N of M enrolled users note appears under it. When provider data isn't available and Hook falls back to the local record, the table loads only the first 100 recipients. Either way, the N total badge reflects the true total even when fewer rows are shown. For the complete picture across everyone, use the executive summary report.

If the table is empty, the message tells you why: a scheduled campaign shows Users will be enrolled when the campaign executes; a campaign with a non-zero recipient count but no loaded rows is headed Recipient list unavailable with Provider metrics loaded, but individual recipients are not available yet; otherwise it reads No enrolled users with No enrolled users are attached to this campaign yet.

Recipient activity table with Name, Email, Activity, and total count

Refreshing and degraded stats

There is no auto-refresh on this page. The numbers you see are a snapshot from when the page loaded. Click Refresh in the top-right of the header to re-pull the latest metrics and recipient activity from PhishingBox.

Stats fall back to local data in two situations. When a campaign has a provider ID but PhishingBox can't be reached — a timeout or an error on the live report fetch — the stats fall back to local values: Enrolled keeps its recipient count, but Sent, Opened, Clicked, and Reported all read 0 because those totals only exist on the provider side. The contextual banner flips to Provider statistics are temporarily unavailable. Clicking Refresh retries the live fetch; transient provider hiccups usually clear on the next attempt.

A campaign that hasn't synced to the provider yet — its Provider ID still reads Pending — also shows local-only numbers (Sent / Opened / Clicked / Reported at 0), but the banner stays on the default Live engagement statistics are pulled from PhishingBox note rather than the "temporarily unavailable" warning. The "temporarily unavailable" banner appears only once a provider ID exists and the live fetch fails.

Why a number can drop to zero

Seeing engagement counts go to zero after a refresh almost always means the live fetch failed, not that activity was lost. Check the banner: if it says temporarily unavailable, refresh again in a moment. If clicks consistently won't deliver or track, see Troubleshoot phishing delivery.

Common pitfalls

Failed campaigns can't be retried in place. If the status badge reads Failed, the sync to the delivery provider didn't complete. There's no "retry" button — create a fresh campaign from Run a phishing campaign.
A campaign you don't own shows "Campaign unavailable." The detail page is scoped to your selected organization. Opening a campaign id that belongs to another org returns Campaign unavailable (the lookup is filtered by both campaign id and organization to prevent cross-org access). Confirm you have the right organization selected in the switcher.
Refresh the list after launching. If you just launched a campaign and don't see the expected status yet, click Refresh on /org/phishing to pull the latest campaign state.