Proofpoint - Whitelisting

This support article is for AntiPhish customers and will cover how to whitelist our simulated phishing email domains within Proofpoint.

Our Phishing Server Details

Click is our AntiPhish phishing server which has the domain and hostname of 'click.antiphish.training'.

The public IP address is '142.93.32.36'

Proofpoint Whitelisting

Proofpoint offer a number of different spam filtering solutions and whitelisting will be required to ensure simulated phishing test emails, sent from our AntiPhish domain host and IP above will be received by your end users. If these messages get blocked, that becomes a successful test of Proofpoint's ability to filter suspicious messages however not much of a phishing simulation for the end user...

Proofpoint Essentials - Whitelisting

If Proofpoint Essentials is used within your environment then please perform the following instructions which are taken from Proofpoint's support article titled Safelisting Addresses.

1. Navigate to Security Settings > Email > Sender Lists.
2. Under the Safe Sender list, enter our IP address 142.93.32.36.
3. Click Save.
4. Repeat steps 2 and 3 for the following additional records:
   1. click.antiphish.training
   2. referrals.ltd
   3. no-replies.co
   4. msoft-app.co.uk
   5. promotions-co.uk
   6. sharedfiles.co.uk
   7. wwwbilling.co.uk
   8. acc-system.co.uk
   9. sharefile-co.uk
   10. sso-signin.co.uk
   11. apistech.co.uk

If any issues are encountered with inbound emails that include attachments. Please refer to Proofpoint's Block by Default article for further information.

Proofpoint Enterprise - Whitelisting

If ProofPoint Enterprise is used within your environment then please perform the following instructions:

1. Navigate to your Proofpoint Enterprise Admin console.
2. Click Email Protection.
3. Under the Spam Detection drop-down, select Organizational Safe List.
4. Click Add.
5. In the Proofpoint - Global Safe List window, enter the following information:
   • Filter Type: From the drop-down menu, select Sender Hostname.
   • Operator: From the drop-down menu, select Equals.
   • Value: In the field, enter the IP address 142.93.32.36.
6. Click Save Changes.
7. Repeat steps 4 and 6 for the following additional records:
   1. click.antiphish.training
   2. referrals.ltd
   3. no-replies.co
   4. msoft-app.co.uk
   5. promotions-co.uk
   6. sharedfiles.co.uk
   7. wwwbilling.co.uk
   8. acc-system.co.uk
   9. sharefile-co.uk
   10. sso-signin.co.uk
   11. apistech.co.uk

To avoid potential issues with Proofpoint’s Targeted Attack Protection (TAP), it is recommended that AntiPhish's IP address is also added to Proofpoint’s URL Defense. To add this to Proofpoint's URL Defense, follow the steps below:

1. Navigate to your Proofpoint Essentials Admin console.
2. Click Email Protection.
3. Under the Targeted Attack Protection drop-down, select URL Defense.
4. Click URL Rewrite Policies.
5. Under the Exceptions section, enter the IP addresses 142.93.32.36
6. In the same section, enter the domain click.antiphish.training.
7. Click Save Changes.
8. Repeat steps 6 and 7 for the following additional records:
   1. referrals.ltd
   2. no-replies.co
   3. msoft-app.co.uk
   4. promotions-co.uk
   5. sharedfiles.co.uk
   6. wwwbilling.co.uk
   7. acc-system.co.uk
   8. sharefile-co.uk
   9. sso-signin.co.uk
   10. apistech.co.uk

Organizational Safe List

Despite the IP and domain for AntiPhish being whitelisted, it is still possible that inbound emails will be held in quarantine or sent to recipient spam folders within the mailbox. If this occurs, AntiPhish can also be added to the Organizational Safe list within ProofPoint by following these steps:

1. From your Proofpoint admin center, navigate to Email Protection > Spam Detection > Organizational Safe List.
2. Add AntiPhish's IP address 142.93.32.36
3. Repeat steps 2 for the following additional records:
   1. click.antiphish.training
   2. referrals.ltd
   3. no-replies.co
   4. msoft-app.co.uk
   5. promotions-co.uk
   6. sharedfiles.co.uk
   7. wwwbilling.co.uk
   8. acc-system.co.uk
   9. sharefile-co.uk
   10. sso-signin.co.uk
   11. apistech.co.uk

Note: SPAM and Phishing emails are evaluated under the safe list however the "score" assigned to a message is different between SPAM and a Phishing message. If the domains and IP address above are added to the safe list however messages continue to be diverted to the SPAM/Junk folder or quarantine then an additional policy can be created. This additional policy will need to include the IP address 142.93.32.36 and the domains listed above along with a custom rule that resets the Phish score to 0.

Domains Last Updated - 16/11/2023