Phish Hook™ add-on button for Microsoft Outlook (when used with Exchange/365) and Google Workspace (Gmail).

Overview

This API provides the ability to report both simulated and non-simulated phishing emails to either an email resource (such as the internal security team) or the Phishing Tackle platform.

They are reported to the Phishing Tackle platform using methods found in this documentation if they are a simulated phishing email sent by our platform, or forwarded to the email destination as an attachment if the email is to be investigated further.

Usage

End-users click the button (either within Microsoft Outlook or Google Workspace Gmail) to report a suspected phishing email.

If the email was sent from the Phishing Tackle platform.

There will be the following header (the value before the @ will change for each email).

Message-ID: MjAyMTA1MTQxNTM3MDg4NDExYmQ2ZjUyZi1iZjEyLTRjNTEtOTVmMi1mOThjZGZkZTc5M2M=@tacklephishing.com

The ReportSuspiciousEmail API method should be called (with the above value before the @ sign in the ptId form data property to record this submission, which indicates that the user has successfully spotted a simulated email.

If you email was NOT sent from the Phishing Tackle platform.

The above header will not be present in the email and, as such, no method will be called. The email should be forwarded (as an attachment) to the email address returned by the GetForwardingAddress API method.

After Reporting

After the email is reported, it must then be moved to end-users "Deleted" mail folder.

Authentication

The REST call is authenticated using the auth_token passed in the POST form data.

Egress Routes

The following egress routes are required from each Phish Hook™ user (specifically allowing these will only be required if egress traffic is locked down preventing general internet access):

https://www.tacklephishing.com/phishhook
https://www.tacklephishing.com/phishhook/Images
https://www.tacklephishing.com/phishhook/Functions
https://www.tacklephishing.com/phishhook/api/v1/phishhook

Further Reading

For look-and-feel information on how the current Microsoft Outlook plugin works, please see the following help article within our knowledge base.

https://support.phishingtackle.com/hc/en-gb/articles/360038452171-How-to-use-the-Phish-Hook-Button