WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"618531766c8f1ea93f7107f725f94db320990a4550927dafb8b37fc59dc03760","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/618531766c8f1ea93f7107f725f94db320990a4550927dafb8b37fc59dc03760","threatTime":"2023-10-23T14:39:04.000Z","threat":"http://pub-b5b2e13a95eb437696adc86931bffc7a.r2.dev/blue.html","campaignID":null,"threatType":"url"},{"threatID":"77f4e1fe753dc4782d533f50f9d13b6e8dcc007aa7c57cbb67f08f073b651c8e","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/77f4e1fe753dc4782d533f50f9d13b6e8dcc007aa7c57cbb67f08f073b651c8e","threatTime":"2023-10-23T13:52:49.000Z","threat":"pub-b5b2e13a95eb437696adc86931bffc7a.r2.dev/blue.html","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-22T10:44:22.000Z","impostorScore":0,"malwareScore":0,"cluster":"acme_hosted","subject":"CalPrivate Bank - S-INV-0000010319","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound","allow_relay","yanroute"],"modulesRun":["av","dkimv","spf","sandbox","spam","dmarc","urldefense"],"messageSize":177623,"headerFrom":"Accounts <ap1@gosmartoffice.com>","headerReplyTo":null,"fromAddress":["ap1@gosmartoffice.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["fyoung@acme.bank"],"xmailer":null,"messageParts":[{"disposition":"attacmeed","sha256":"5ee7ae20cbcc9b78bf31af54831fd206e4fb3db9d0b00d141ece2b6ad056f0d2","md5":"dc6e37ec07372cfb1085aa553e8297a0","filename":null,"sandboxStatus":"NOT_SUPPORTED","oContentType":"text/plain","contentType":"text/plain"},{"disposition":"attacmeed","sha256":"c275c484ce2d9e99a7499a909ed65b8aefa563ad63089a56c18396709d6eb098","md5":"66b5aeb5915bc33793a8c36288589029","filename":"invoice - 10105008007835  hg0280446.msg","sandboxStatus":"CLEAN","oContentType":"application/vnd.ms-outlook","contentType":"application/vnd.ms-outlook"},{"disposition":"attacmeed","sha256":"edcb807558c1eae66b40ad45d07c66113b6d0b9f8e6c598c6161b0fd76d1374d","md5":"ce530b3dc1e760be597ce185f82f4c53","filename":null,"sandboxStatus":"CLEAN","oContentType":"application/rtf","contentType":"application/rtf"},{"disposition":"attacmeed","sha256":"ba5fff498f2b7d93d285172fc55a99436efbdbf623b27b0fb39974f687536aaf","md5":"a44b8e55204b34f0efca2a4163640d57","filename":"image001.jpg","sandboxStatus":"NOT_SUPPORTED","oContentType":"image/jpeg","contentType":"image/jpeg"},{"disposition":"inline","sha256":"c37fe5a2b5673280ae3054722248261e148f715c3d98cdffceabd2f453326adf","md5":"d3fe2e21f1a5ef9cfc7b4e84a03b44c4","filename":"text.txt","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/plain","contentType":"text/plain"},{"disposition":"inline","sha256":"a72907405a962641495b6e5846503d821cdc81048b1804caac1f8133dc8b4fcf","md5":"c64a68fe6bc0ce679dc981349dc3a167","filename":"text.html","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"321f17a3-aa30-ebec-b580-0bc6bea26dc0","QID":"3tvagqgamk-1","GUID":"LM5LS6qUc-IGV1FHmDIS1ByHl4YJqZVy","sender":"ap1@gosmartoffice.com","recipient":["fyoung@acme.bank"],"senderIP":"1.6.40.108","messageID":"<CO3PR06MB860690C7B9556DC0A9286B67E4D9A@CO3PR06MB8606.namprd06.prod.outlook.com>"} ::: fileHash=<CO3PR06MB860690C7B9556DC0A9286B67E4D9A@CO3PR06MB8606.namprd06.prod.outlook.com> ::: fileName=from: ap1@gosmartoffice.com subj: CalPrivate Bank - S-INV-0000010319 ::: serverIP=1.6.40.108 ::: emailFrom=ap1@gosmartoffice.com ::: created_at=2023-10-22T10:44:22.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=CalPrivate Bank - S-INV-0000010319 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-22T10:44:22.000Z ::: emailSendingServer=1.6.40.108 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "ap1@gosmartoffice.com",
    "emailsendingserver": "40.107.243.104",
    "emailsubject": "CalPrivate Bank - S-INV-0000010319",
    "filehash": "<CO3PR06MB860690C7B9556DC0A9286B67E4D9A@CO3PR06MB8606.namprd06.prod.outlook.com>",
    "filename": "from: ap1@gosmartoffice.com subj: CalPrivate Bank - S-INV-0000010319",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"618531766c8f1ea93f7107f725f94db320990a4550927dafb8b37fc59dc03760\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/618531766c8f1ea93f7107f725f94db320990a4550927dafb8b37fc59dc03760\",\"threatTime\":\"2023-10-23T14:39:04.000Z\",\"threat\":\"http://pub-b5b2e13a95eb437696adc86931bffc7a.r2.dev/blue.html\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"77f4e1fe753dc4782d533f50f9d13b6e8dcc007aa7c57cbb67f08f073b651c8e\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/77f4e1fe753dc4782d533f50f9d13b6e8dcc007aa7c57cbb67f08f073b651c8e\",\"threatTime\":\"2023-10-23T13:52:49.000Z\",\"threat\":\"pub-b5b2e13a95eb437696adc86931bffc7a.r2.dev/blue.html\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-10-22T10:44:22.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"acme_hosted\",\"subject\":\"CalPrivate Bank - S-INV-0000010319\",\"quarantineFolder\":\"Phish\",\"quarantineRule\":\"inbound_phish\",\"policyRoutes\":[\"default_inbound\",\"allow_relay\",\"yanroute\"],\"modulesRun\":[\"av\",\"dkimv\",\"spf\",\"sandbox\",\"spam\",\"dmarc\",\"urldefense\"],\"messageSize\":177623,\"headerFrom\":\"Accounts <ap1@gosmartoffice.com>\",\"headerReplyTo\":null,\"fromAddress\":[\"ap1@gosmartoffice.com\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"fyoung@acme.bank\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"attacmeed\",\"sha256\":\"5ee7ae20cbcc9b78bf31af54831fd206e4fb3db9d0b00d141ece2b6ad056f0d2\",\"md5\":\"dc6e37ec07372cfb1085aa553e8297a0\",\"filename\":null,\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"},{\"disposition\":\"attacmeed\",\"sha256\":\"c275c484ce2d9e99a7499a909ed65b8aefa563ad63089a56c18396709d6eb098\",\"md5\":\"66b5aeb5915bc33793a8c36288589029\",\"filename\":\"invoice - 10105008007835  hg0280446.msg\",\"sandboxStatus\":\"CLEAN\",\"oContentType\":\"application/vnd.ms-outlook\",\"contentType\":\"application/vnd.ms-outlook\"},{\"disposition\":\"attacmeed\",\"sha256\":\"edcb807558c1eae66b40ad45d07c66113b6d0b9f8e6c598c6161b0fd76d1374d\",\"md5\":\"ce530b3dc1e760be597ce185f82f4c53\",\"filename\":null,\"sandboxStatus\":\"CLEAN\",\"oContentType\":\"application/rtf\",\"contentType\":\"application/rtf\"},{\"disposition\":\"attacmeed\",\"sha256\":\"ba5fff498f2b7d93d285172fc55a99436efbdbf623b27b0fb39974f687536aaf\",\"md5\":\"a44b8e55204b34f0efca2a4163640d57\",\"filename\":\"image001.jpg\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"image/jpeg\",\"contentType\":\"image/jpeg\"},{\"disposition\":\"inline\",\"sha256\":\"c37fe5a2b5673280ae3054722248261e148f715c3d98cdffceabd2f453326adf\",\"md5\":\"d3fe2e21f1a5ef9cfc7b4e84a03b44c4\",\"filename\":\"text.txt\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"},{\"disposition\":\"inline\",\"sha256\":\"a72907405a962641495b6e5846503d821cdc81048b1804caac1f8133dc8b4fcf\",\"md5\":\"c64a68fe6bc0ce679dc981349dc3a167\",\"filename\":\"text.html\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"321f17a3-aa30-ebec-b580-0bc6bea26dc0\",\"QID\":\"3tvagqgamk-1\",\"GUID\":\"LM5LS6qUc-IGV1FHmDIS1ByHl4YJqZVy\",\"sender\":\"ap1@gosmartoffice.com\",\"recipient\":[\"fyoung@acme.bank\"],\"senderIP\":\"1.6.40.108\",\"messageID\":\"<CO3PR06MB860690C7B9556DC0A9286B67E4D9A@CO3PR06MB8606.namprd06.prod.outlook.com>\"} ::: fileHash=<CO3PR06MB860690C7B9556DC0A9286B67E4D9A@CO3PR06MB8606.namprd06.prod.outlook.com> ::: fileName=from: ap1@gosmartoffice.com subj: CalPrivate Bank - S-INV-0000010319 ::: serverIP=1.6.40.108 ::: emailFrom=ap1@gosmartoffice.com ::: created_at=2023-10-22T10:44:22.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=CalPrivate Bank - S-INV-0000010319 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-22T10:44:22.000Z ::: emailSendingServer=1.6.40.108 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-10-22T10:44:22.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "1.6.40.108"
}