If you are using Microsoft Defender Plan 2, then Microsoft Safe Links is probably re-writing URLs in your incoming emails. Some of them are from our Security Awareness Service and are also put into the quarantine from Microsoft. Please complete the following steps to prevent them to get quarantined by Microsoft:

1. In the Microsoft 365 Defender portal (security.microsoft.com) navigate to
   Email & Collaboration > Policies & Rules > Threat policies > Advanced delivery.
2. On the Advanced delivery page, select the Phishing simulation tab, then click on "Edit".
3. In the Edit third-party phishing simulation panel, configure the following setting:
   1. under Simulation URLs to allow enter:

      atpscan.global.hornetsecurity.com/*

   2. Click "Save" and then "Close".
4. If not already done, please also add the listed IP ranges from this article.
5.  

Please be advised that using any additional filtering service is not recommended by Hornetsecurity.