Setting Up Allowlisting for Phin Security

We have built this guide to make allowlisting as easy as possible for you and your team.

To ensure emails for training and phishing make it through your email filtering process, you will need to allow the following sending IPs, domains, and simulated URLs to be listed. The guide below is broken down into each allowlist scenario depending on the platforms you use.

Microsoft Outlook Users

• Microsoft Automated Allowlisting

• Microsoft Manual Allowlisting
  
  • IPs, Domains, URLs

Google Workspace Users

Graph API Mail Delivery

Microsoft Outlook Users

Microsoft Automated Allowlisting

Automated allowlisting performs all the steps for you listed in manual allowlisting with the single press of a button. Follow these instructions to enable automated allowlisting at the company level.

1. Navigate to Company > Integrations > Microsoft Automated Allowlisting
2. Click Continue to Microsoft (After reviewing the necessary permissions)
3. Log into Microsoft and grant consent for the integration at which time you will be navigated back to the Phin.
4. Once the verification step is done, the integration will begin the allowlisting procedure immediately, pushing all of the most up-to-date sending IPs, sending domains, and simulated URLs into Microsoft Defender > Policies & Rules > Threat Policies > Advanced Delivery > Phishing Simulation.
   1. Automated Allowlisting should take no more than a couple of minutes per company and can be done simultaneously in new tabs (you don't have to wait for one company to finish before proceeding to the next).
5. Once the allowlist service is done, you'll be presented with either a success or failure message. A success message will be accompanied by an output of what was updated.
   1. Success: If everything comes back as successful, we recommend navigating to Advanced Delivery> Phishing Simulation, confirming you see the injected sending IPs, domains, and simulated URLs listed. If you do not see them, please disconnect and re-attempt automated allowlisting or submit a ticket to the Phin support team.
      
      
   2. If you receive an error message, please disconnect and re-attempt automated allowlisting, as this typically resolves the issue. If you experience repeated failed attempts, please submit a ticket to the Phin support team.
6. Continue steps 1-5 on all companies. 

Microsoft Manual Allowlisting

1. Go to https://security.microsoft.com/
2. Select Policies and Rules from the Email & collaboration section in the menu on the left
3. Then select Threat policies
4. Click the Advanced Delivery in the Rules section
5. Select the Phishing Simulation tab
6. Click Edit to add IPs, URLs, and domains (listed below).
7. Enable Transport Rule 1 (REQUIRED): The first rule will force Phin emails to show in users' inboxes.
   1. Go to https://admin.exchange.microsoft.com/#/
   2. Select Mail flow > Rules in the sidebar navigation on the left
   3. + Add a rule > Create a new rule with the following information
      1. Name: Bypass Focused Inbox and Spam Filter for Phin
      2. Apply this rule if*
         • Dropdown 1 = The sender
         • Dropdown 2 = IP address is in any of these ranges or exactly matches
         • Add each of these IPs: 198.2.177.227, 198.2.178.214, 198.244.59.179, 35.237.125.73
      3. Do the following*
         • Dropdown 1 = Modify the message properties
         • Dropdown 2 = Set the spam confidence level (SCL)
         • Set the spam confidence level (SCL) = Bypass spam filtering
      4. And*
         • Dropdown 1 = Modify the message properties
         • Dropdown 2 = Set the message header
         • Set the message header to "X-MS-Exchange-Organization-BypassFocusedInbox"
         • Set the value to "True"
      5. Here is an example of what the rule should look like once completed.
8. Enable Transport Rule 2 (OPTIONAL): The second rule is optional and only applicable to partners who have chosen to generate a 'Custom Header' in a company's settings page. The following rule will set a spam confidence level (SCL) of -1 to all end-user Phin emails (phishing & training).
   
   1. Go to https://admin.exchange.microsoft.com/#/
   2. Select Mail flow > Rules in the sidebar navigation on the left
   3. + Add a rule > Create a new rule with the following information
      1. Name: Set SCL for X-PHIN-CUSTOM header
      2. Apply this rule if*
         • Dropdown 1 = The message headers
         • Dropdown 2 = matches these text patterns
         • Enter text = X-PHIN-CUSTOM
         • Enter words = {insert the company custom header found in Phin portal}
      3. Do the following*
         • Dropdown 1 = Modify the message properties
         • Dropdown 2 = Set the spam confidence level (SCL)
         • Set the spam confidence level (SCL) = Bypass spam filtering
           
      4. Here is an example of what the rule should look like once completed.

 

Sending IPs (4)

All of our messages that are sent over SMTP are sent through the following IPs:

• Phishing emails: 198.2.177.227, 198.244.59.179, 35.237.125.73
• Reminders: 198.2.178.214

Simulated URLs (9)

• *.betterphish.com/*
• *.shippingalerts.com/*
• *.amazingdealz.net/*
• *.berrysupply.net/*
• *.coronacouncil.org/*
• *.couponstash.net/*
• *.intelligentbros.com/*
• *.creditsafetyteam.com/*
• *.autheticate.com/*
• *.notificationhandler.com/*

Sending Domains (10)

• phinsecurity.com
• betterphish.com
• shippingalerts.com
• amazingdealz.net
• berrysupply.net
• coronacouncil.org
• couponstash.net
• intelligentbros.com
• creditsafetyteam.com
• autheticate.com
• notificationhandler.com

Additional Resources

Microsoft 365 Defender Advanced Delivery Guide

Allowlisting: Powershell Script

 

---

Google Workspace Users

Allowlisting domains:

Follow these instructions to add our dedicated domains to your approved senders list in Google Workspace. You will need to create an address list with the domains listed below.

Our dedicated sending domains:

• phinsecurity.com,notificationhandler.com,amazingdealz.net,coronacouncil.org,couponstash.net,creditsafetyteam.com,shippingalerts.com,berrysupply.net,autheticate.com,betterphish.com

Allowlisting IPs:

Follow these instructions to add our dedicated sending IPs below to your Google Workspace allowlist.

Our dedicated sending IPs:

• Phishing emails: 198.2.177.227, 198.244.59.179, 35.237.125.73
• Training emails: 198.2.178.214