To ensure that both Hoxhunt report button and training functions smoothly, make sure your proxy, VPN and firewall solutions aren't blocking user's access to Hoxhunt service.
NOTE: Only allowlist these domains and sub-domains if you are experiencing connectivity issues. To help determine whether any of the critical domains are blocked by your network stack, please make use of web browser inspect tool.
Hoxhunt platform-specific domains and sub-domains
Your network stack must allow access to the following key locations:
api.hoxhunt.com - Hoxhunt backend services
auth.hoxhunt.com - log in page and authentication
game.hoxhunt.com - training dashboard for end users
admin.hoxhunt.com - Hoxhunt Admin Portal
insights.hoxhunt.com - Insights reports
response.hoxhunt.com - Threat Feed, Incident Orchestration
reports.hoxhunt.com - Reports portal
Hoxhunt Outlook button-specific domains and sub-domains
In order for Hoxhunt button to operate properly, your network stack must allow access to the following:
Hoxhunt Outlook COM add-in
api.hoxhunt.com
app.hoxhunt.com
game.hoxhunt.com
Hoxhunt Outlook web add-in (manifest.xml)
officejs.hoxhunt.com
ajax.aspnetcdn.com
appsforoffice.microsoft.com
public.hoxhunt.com
cdn.hoxhunt.com
api.hoxhunt.com
auth.hoxhunt.com
app.hoxhunt.com
game.hoxhunt.com
Instant Feedback
response.hoxhunt.com
Training content: images, icons and videos
storage.googleapis.com - images and icons in training content
*.cloudflarestream.com - training videos
videodelivery.net and *.videodelivery.net - training videos
res.cloudinary.com - images in training content
NOTE: Cloudflare manages the video subdomains and may change them without notice. Allow the wildcard domains above rather than individual hosts.
NOTE: In some regions, such as mainland China, access to storage.googleapis.com may be restricted at the network level. Allowlisting it in your own firewall does not remove such restrictions, and affected users may see training content without images or icons.
Voice Phishing SAT Lessons
In Voice Phishing SAT Lessons, users talk with an AI voice agent directly in their web browser. The audio is streamed to Hoxhunt's voice provider, ElevenLabs, over a secure WebSocket connection on TCP port 443. Your network stack must allow access to the following:
api.eu.residency.elevenlabs.io - voice conversation with the AI agent
The lesson itself is loaded from game.hoxhunt.com and api.hoxhunt.com, which are listed above.
NOTE: The conversation runs over a single WebSocket connection that stays open until it ends. Make sure your proxy allows WebSocket connections to the domain above and does not close long-running connections. If the conversation fails to start or stops unexpectedly, exclude this domain from SSL inspection.
NOTE: Voice Phishing SAT Lessons do not use WebRTC. You do not need to open UDP ports or allow TURN or LiveKit servers for them.
NOTE: Users must allow microphone access for game.hoxhunt.com when the browser asks. If your organization manages browser settings centrally, check that policies such as AudioCaptureAllowed and AudioCaptureAllowedUrls in Google Chrome and Microsoft Edge do not block the microphone for game.hoxhunt.com.
Guides for commonly used proxies and VPN clients
We have gathered some resources below for some commonly used proxies and VPN clients, and how to allowlist Hoxhunt within them. If your solution is not on the list, feel free to reach out to your Onboarding Manager or onboarding-team@hoxhunt.com.
Allowlisting Blue Coat / ProxySG proxy solutions
Allowlisting Zscaler proxy solutions
Check connectivity to critical Hoxhunt domains
This section describes how you can perform basic low-level connectivity checks for Hoxhunt services.
Open a web browser.
Try to access the following URLs.
URL |
Expected results |
|---|---|
https://ajax.aspnetcdn.com/ |
You should be redirected to your Microsoft Ajax Content Delivery Network page at https://dotnet.microsoft.com/en-us/apps/aspnet. |
https://appsforoffice.microsoft.com/ |
You should see the following error message: |
https://officejs.hoxhunt.com/ |
You should see the following never-ending loading screen: |
https://api.hoxhunt.com/graphql |
You should see the following message: |
https://game.hoxhunt.com/ |
You should see Hoxhunt login screen
|
https://app.hoxhunt.com/ |
You should see Hoxhunt login screen
|
https://auth.hoxhunt.com/ |
You should see Hoxhunt login screen |
https://public.hoxhunt.com/ |
A long XML response should appear. |
| https://cdn.hoxhunt.com/ | You should see the following error message: |
| https://api.eu.residency.elevenlabs.io/ | You should see the following message: {"detail":"Not Found"} |
If any of the above return something else, please follow the instructions in the error message or make sure nothing is blocking access to the URL. Please contact your network administrator as needed.
Potential blockers include:
Proxy
Firewall
VPN
Systems policy
Check with different web browsers
Please attempt to repeat the following steps with:
Internet Explorer
Microsoft Edge
Google Chrome
Safari (on Mac only)
Check with alternative network connection
It’s always a good idea to narrow down the issue by exclusion. If possible, try to access the URLs with different network configurations:
Enable/disable VPN software
Enable/disable proxy client
Switch between LAN, Wi-Fi and mobile data connection