WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"a67fefacd6e5de07603ed4139ef3078e1bde731019b8aeb85b05ce8299e40e72","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/a67fefacd6e5de07603ed4139ef3078e1bde731019b8aeb85b05ce8299e40e72","threatTime":"2023-09-18T19:19:17.000Z","threat":"racreetescape.com/","campaignID":null,"threatType":"url"},{"threatID":"28c35a387f239cd0fa4d1bd3fcb1bb50080c47dadf9daecf75f59df9b96c9277","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/28c35a387f239cd0fa4d1bd3fcb1bb50080c47dadf9daecf75f59df9b96c9277","threatTime":"2023-10-10T15:20:25.000Z","threat":"28c35a387f239cd0fa4d1bd3fcb1bb50080c47dadf9daecf75f59df9b96c9277","campaignID":null,"threatType":"attumbrellament"},{"threatID":"488ff4e3b779713a1c56985bea4d1bbc5c599abd44af25f6beffeb8debe68051","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/488ff4e3b779713a1c56985bea4d1bbc5c599abd44af25f6beffeb8debe68051","threatTime":"2023-10-10T15:22:15.000Z","threat":"https://racreetescape.com/Mlvaldez@umbrella.bank","campaignID":null,"threatType":"url"},{"threatID":"696347c27089afa9640f3ef1f6e0c091e10c5390a3f06a7846f64b63f94d0b6b","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/696347c27089afa9640f3ef1f6e0c091e10c5390a3f06a7846f64b63f94d0b6b","threatTime":"2023-10-21T14:28:53.000Z","threat":"http://racreetescape.com/","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-10T15:21:20.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"Request for UMBRELLA Details - Urgent Payment Processing","quarantineFolder":"Attumbrellament Defense","quarantineRule":"threat","policyRoutes":["default_inbound","allow_relay"],"modulesRun":["av","dkimv","spf","sandbox","spam","dmarc","urldefense"],"messageSize":10833,"headerFrom":"Account Payable <Invoicing@pekertekstil.com>","headerReplyTo":null,"fromAddress":["invoicing@pekertekstil.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["lvaldez@umbrella.bank"],"xmailer":null,"messageParts":[{"disposition":"attumbrellaed","sha256":"28c35a387f239cd0fa4d1bd3fcb1bb50080c47dadf9daecf75f59df9b96c9277","md5":"a558213d217c91ad9127ca0fc5aaf7d4","filename":"invoice.html","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"},{"disposition":"inline","sha256":"b0a5647e6320845aca995c4143d316a0a96d35cea6be738fc2b0433e456cf098","md5":"6c6c39cece3ba0cfc582ab753cd98b76","filename":"text.html","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"71d6b716-0283-fc19-f163-3fa475d73bc3","QID":"3tkhk88vug-1","GUID":"_BdZz9EM4WZQMuOBsIwkcWcySUkIZjKf","sender":"invoicing@pekertekstil.com","recipient":["lvaldez@umbrella.bank"],"senderIP":"240.154.246.221","messageID":"<e8c41f02fdd1c1720a27594e8aa707f27ca6d6f4630111a52ac3628f94199657@pekertekstil.com>"} ::: fileHash=<e8c41f02fdd1c1720a27594e8aa707f27ca6d6f4630111a52ac3628f94199657@pekertekstil.com> ::: fileName=from: invoicing@pekertekstil.com subj: Request for UMBRELLA Details - Urgent Payment Processing ::: serverIP=240.154.246.221 ::: emailFrom=invoicing@pekertekstil.com ::: created_at=2023-10-10T15:21:20.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Request for UMBRELLA Details - Urgent Payment Processing ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-10T15:21:20.000Z ::: emailSendingServer=240.154.246.221 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "invoicing@pekertekstil.com",
    "emailsendingserver": "40.107.22.57",
    "emailsubject": "Request for ACH Details - Urgent Payment Processing",
    "filehash": "<e8c41f02fdd1c1720a27594e8aa707f27ca6d6f4630111a52ac3628f94199657@pekertekstil.com>",
    "filename": "from: invoicing@pekertekstil.com subj: Request for ACH Details - Urgent Payment Processing",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":100,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"a67fefacd6e5de07603ed4139ef3078e1bde731019b8aeb85b05ce8299e40e72\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/a67fefacd6e5de07603ed4139ef3078e1bde731019b8aeb85b05ce8299e40e72\",\"threatTime\":\"2023-09-18T19:19:17.000Z\",\"threat\":\"racreetescape.com/\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"28c35a387f239cd0fa4d1bd3fcb1bb50080c47dadf9daecf75f59df9b96c9277\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/28c35a387f239cd0fa4d1bd3fcb1bb50080c47dadf9daecf75f59df9b96c9277\",\"threatTime\":\"2023-10-10T15:20:25.000Z\",\"threat\":\"28c35a387f239cd0fa4d1bd3fcb1bb50080c47dadf9daecf75f59df9b96c9277\",\"campaignID\":null,\"threatType\":\"attumbrellament\"},{\"threatID\":\"488ff4e3b779713a1c56985bea4d1bbc5c599abd44af25f6beffeb8debe68051\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/488ff4e3b779713a1c56985bea4d1bbc5c599abd44af25f6beffeb8debe68051\",\"threatTime\":\"2023-10-10T15:22:15.000Z\",\"threat\":\"https://racreetescape.com/Mlvaldez@umbrella.bank\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"696347c27089afa9640f3ef1f6e0c091e10c5390a3f06a7846f64b63f94d0b6b\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/696347c27089afa9640f3ef1f6e0c091e10c5390a3f06a7846f64b63f94d0b6b\",\"threatTime\":\"2023-10-21T14:28:53.000Z\",\"threat\":\"http://racreetescape.com/\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-10-10T15:21:20.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"umbrella_hosted\",\"subject\":\"Request for UMBRELLA Details - Urgent Payment Processing\",\"quarantineFolder\":\"Attumbrellament Defense\",\"quarantineRule\":\"threat\",\"policyRoutes\":[\"default_inbound\",\"allow_relay\"],\"modulesRun\":[\"av\",\"dkimv\",\"spf\",\"sandbox\",\"spam\",\"dmarc\",\"urldefense\"],\"messageSize\":10833,\"headerFrom\":\"Account Payable <Invoicing@pekertekstil.com>\",\"headerReplyTo\":null,\"fromAddress\":[\"invoicing@pekertekstil.com\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"lvaldez@umbrella.bank\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"attumbrellaed\",\"sha256\":\"28c35a387f239cd0fa4d1bd3fcb1bb50080c47dadf9daecf75f59df9b96c9277\",\"md5\":\"a558213d217c91ad9127ca0fc5aaf7d4\",\"filename\":\"invoice.html\",\"sandboxStatus\":\"THREAT\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"inline\",\"sha256\":\"b0a5647e6320845aca995c4143d316a0a96d35cea6be738fc2b0433e456cf098\",\"md5\":\"6c6c39cece3ba0cfc582ab753cd98b76\",\"filename\":\"text.html\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"71d6b716-0283-fc19-f163-3fa475d73bc3\",\"QID\":\"3tkhk88vug-1\",\"GUID\":\"_BdZz9EM4WZQMuOBsIwkcWcySUkIZjKf\",\"sender\":\"invoicing@pekertekstil.com\",\"recipient\":[\"lvaldez@umbrella.bank\"],\"senderIP\":\"240.154.246.221\",\"messageID\":\"<e8c41f02fdd1c1720a27594e8aa707f27ca6d6f4630111a52ac3628f94199657@pekertekstil.com>\"} ::: fileHash=<e8c41f02fdd1c1720a27594e8aa707f27ca6d6f4630111a52ac3628f94199657@pekertekstil.com> ::: fileName=from: invoicing@pekertekstil.com subj: Request for UMBRELLA Details - Urgent Payment Processing ::: serverIP=240.154.246.221 ::: emailFrom=invoicing@pekertekstil.com ::: created_at=2023-10-10T15:21:20.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Request for UMBRELLA Details - Urgent Payment Processing ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-10T15:21:20.000Z ::: emailSendingServer=240.154.246.221 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-10-10T15:21:20.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "240.154.246.221"
}