CyberHoot’s Email-Relay IP Addresses, Domains, and Allow-list Articles

CyberHoot’s Email-Relay IP Addresses, Domains, and Allow-list Articles


Updated: May 8th, 2025

This article is a reference to CyberHoot’s mail relay IP Addresses and Domain names.  The process of allowing phishing tests through to your end users inboxes is dependent upon your mail and spam filters.  CyberHoot provides instructions and scripts on bypassing Microsofts Spam, Clutter, and Junk filters as well as adding our mail domains to the safe senders lists.  

Please note that if you are using multiple filters in series, you will also need to set up X-Headers in addition to allow lists to deliver email to your end users.  You may wish to run powershell scripts we have prepared to make your life easier.

CyberHoot Training Assignments Relay:

CyberHoot assignments are delivered via email.  Currently, all assignments flow through AWS SES, as such, there is no need to create an allow list as AWS SES reputation is excellent, but if you choose to, you can add our domain name and the following IP addresses below to the allow list.

  • DNS Name:  cyberhoot.com
  • IP Addresses: 54.240.125.36/32 and 54.240.125.37/32

Phishing Test Mail Relays

If you are planning on sending traditional (attack-based) Phishing Tests to your clients and prospects, you will need to enable all of CyberHoot’s Email Relays shown below:

DNS DOMAIN Names:IP Addresses:
ch-account-2fa.com3.212.253.236/32
ch-contact-us.com34.235.208.123/32
ch-login-created.com44.209.10.205/32
ch-password-reset.com52.200.160.242/32
ch-security-alert.com54.164.218.52/32
docunotice.com23.20.251.170/32
messagecenters.net52.7.191.238/32
securedinbox.net52.6.6.155/32
notificationhub.net18.213.175.22/32
filealert.org34.226.89.171/32

Looking for a downloadable copy of the table above in CSV format?

And here we have  a comma separated list with just the domain names:
ch-account-2fa.com,ch-contact-us.com,ch-login-created.com,ch-password-reset.com,ch-security-alert.com,docunotice.com,messagecenters.net,securedinbox.net,notificationhub.net,filealert.org

Another list, this time just the IP addresses:
3.212.253.236/32,34.235.208.123/32,44.209.10.205/32,52.200.160.242/32,54.164.218.52/32,23.20.251.170/32,52.7.191.238/32,52.6.6.155/32,18.213.175.22/32,34.226.89.171/32

*As of May 8th, 2025 all of CyberHoot’s Phish testing will be sent from these IP addresses.

    • Related Articles

    • HowTo: Allow-List CyberHoot’s Mail-Relay IP Address – Mimecast

      This article will walk you through setting up allow list in Mimecast. The required IP address and Domain name information is found in this HowTo article: CyberHoot Email-Relay IP Addresses, Domains, and Allow-Listing Articles

    • HowTo: Allow-List CyberHoot’s Mail-Relays in M365

      High-Level Instructions: This HowTo video walks you through allow-listing CyberHoot’s Mail-Relay by either Domain Name or IP Addresses in Microsoft’s O365 environment. This process is very similar whether you use the domain names shown below or the ...

    • HowTo: Allow-List CyberHoot’s AttackPhish Simulation Servers in M365

      Detailed Instructions From Microsoft: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/skip-filtering-phishing-simulations-sec-ops-mailboxes?view=o365-worldwide Once you click the link above, follow the instructions under ...

    • HowTo: Allow-List CyberHoot – Personal Gmail Account

      If you sign up to receive CyberHoot BootCamp as an individual, you may need to allow-list the CyberHoot Domain in your own personal Gmail account. Here’s the instructions in a quick video for how to accomplish that. https://youtu.be/VzXBGn-g5eI ...

    • HowTo: Allow-List in Barracuda

      If you’re utilizing Barracuda’s Email Security Gateway, you can white-list CyberHoot IP Addresses and Domain Name to allow our simulated phishing test emails and training notifications to get through to your end-user’s inboxes. Please see this ...