Using Windows Sandbox for Safe Phishing URL Analysis with Network Isolation

Yes, Windows Sandbox automatically uses the same network connection as the host, so by default it can reach anything the host can, including internal company systems. If you want to stop analysts from scanning your corporate subnets, you’ll need to block that access at the firewall level. The simplest way is to create outbound rules in Windows Defender Firewall that apply only to the Sandbox process, allowing internet traffic but denying access to private IP ranges. Another option is to place the host in a VLAN or force Sandbox traffic through a proxy that blocks internal addresses. Microsoft doesn’t provide a built‑in “isolated network mode” for Sandbox, so the isolation has to be enforced with firewall or network configuration.