WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"8132a7efd4e0e682020db800c2cb1bfe1d99a85d0e0e2bf357c6a47cab1e2f9a","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/8132a7efd4e0e682020db800c2cb1bfe1d99a85d0e0e2bf357c6a47cab1e2f9a","threatTime":"2023-10-21T12:11:24.000Z","threat":"https://linkprotect.cudasvc.com/url?a=www.google.gg/amp/s/mailfiles.online/MdHdvcm5oYW1Ac2FuZGllZ29wcml2YXRlYmFuay5uZXQ=&c=E,1,RHmAtRtvh3Xjkp0o9U9OT03Z5NUzzlLucALp_SJJJWR1Xmh6DO7zW9jWv190uL58dEKoYea-eq8iWB29jHY4d9c12Gfz6LOW0fq6nJwuL8O5&typo=0","campaignID":null,"threatType":"url"},{"threatID":"60ac1af21fc95571bfc5e78d3a081b1fdbaeba07e84aa55d6a371eaca4b22066","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/60ac1af21fc95571bfc5e78d3a081b1fdbaeba07e84aa55d6a371eaca4b22066","threatTime":"2023-10-20T23:39:26.000Z","threat":"www.google.gg/amp/s/mailfiles.online/","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-21T12:10:38.000Z","impostorScore":0,"malwareScore":0,"cluster":"acme_hosted","subject":"Sandiegoprivatebank Financial Statements 10.23.pdf","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","spf","spam","dmarc","pdr","urldefense"],"messageSize":7631,"headerFrom":"\"Finance shared Financial Statements 10.23.pdf\"\r\n <noreply@hotyoga-caldo.com>","headerReplyTo":null,"fromAddress":["noreply@hotyoga-caldo.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["twornham@sandiegoprivatebank.net"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"3f686cde4c45d6a1635f0b968800dc55cf9b2e043fdf050087ea6fb8710b761f","md5":"bbe6ff11f76031194b7053cb2ab7f125","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"2d007571-69eb-e5f5-2e62-674584c9b8e9","QID":"3tvagqg1q6-1","GUID":"PRR03G6mGb286FOVJDonoGYnke19ODIs","sender":"noreply@hotyoga-caldo.com","recipient":["twornham@sandiegoprivatebank.net"],"senderIP":"68.112.22.205","messageID":"<5e401aa9-ccac-7c06-ef27-5747b6cb6f1b@hotyoga-caldo.com>"} ::: fileHash=<5e401aa9-ccac-7c06-ef27-5747b6cb6f1b@hotyoga-caldo.com> ::: fileName=from: noreply@hotyoga-caldo.com subj: Sandiegoprivatebank Financial Statements 10.23.pdf ::: serverIP=68.112.22.205 ::: emailFrom=noreply@hotyoga-caldo.com ::: created_at=2023-10-21T12:10:38.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Sandiegoprivatebank Financial Statements 10.23.pdf ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-21T12:10:38.000Z ::: emailSendingServer=68.112.22.205 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: noreply@hotyoga-caldo.com
emailsendingserver: 150.60.29.210
emailsubject: Sandiegoprivatebank Financial Statements 10.23.pdf
filehash: <5e401aa9-ccac-7c06-ef27-5747b6cb6f1b@hotyoga-caldo.com>
filename: from: noreply@hotyoga-caldo.com subj: Sandiegoprivatebank Financial Statements 10.23.pdf
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-10-21T12:10:38.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 68.112.22.205