WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"6a0f50443e0088ea7330880fea7e0d95c52c3e0b8932a6f6c45f01f9c4cfeb3e","threatStatus":"active","classification":"malware","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/6a0f50443e0088ea7330880fea7e0d95c52c3e0b8932a6f6c45f01f9c4cfeb3e","threatTime":"2023-11-01T14:33:07.000Z","threat":"http://www.verticalresponse.com/landing/ef/?mm/13009f2b4f&utm_campaign=footer&utm_medium=referral&utm_source=footer","campaignID":"87cca984-0077-46fc-9a25-2f9a579361a9","threatType":"url"},{"threatID":"103fb82f67858c81e62186778071f71fe1edbe1924b003127fb1b9411edf5160","threatStatus":"active","classification":"malware","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/103fb82f67858c81e62186778071f71fe1edbe1924b003127fb1b9411edf5160","threatTime":"2023-10-30T16:34:44.000Z","threat":"https://verticalresponse.com/about/policy-and-terms","campaignID":null,"threatType":"url"},{"threatID":"c4044910a040660f48caa5b650ba7aafa0786ea01f33ad31b8d0508b0dbaef0b","threatStatus":"active","classification":"malware","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/c4044910a040660f48caa5b650ba7aafa0786ea01f33ad31b8d0508b0dbaef0b","threatTime":"2023-11-01T09:39:23.000Z","threat":"https://verticalresponse.com/about","campaignID":"87cca984-0077-46fc-9a25-2f9a579361a9","threatType":"url"},{"threatID":"5986731d9d59f3dc0629eae7c019b8f150c914f826feb34b8bff5dewayne4d9891","threatStatus":"active","classification":"malware","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/5986731d9d59f3dc0629eae7c019b8f150c914f826feb34b8bff5dewayne4d9891","threatTime":"2023-10-31T00:35:06.000Z","threat":"https://verticalresponse.com/about/policy-and-terms/","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-25T15:44:59.000Z","impostorScore":0,"malwareScore":0,"cluster":"wayne_hosted","subject":"Promo Items - $25 Off Your Next Order, Order Now","quarantineFolder":"Bulk","quarantineRule":"inbound_bulk","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":39668,"headerFrom":"\"Promo Direct\" <Promo_Direct@mail.vresp.com>","headerReplyTo":"\"Promo Direct\" <reply-13009f2b4f-e25654848b-9a9b@u.cts.vresp.com>","fromAddress":["promo_direct@mail.vresp.com"],"ccAddresses":[],"replyToAddress":["394fdffbcf529731f6709bd54a7dab7c@u.cts.vresp.com>"],"toAddresses":["lgonzalez@wayne.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"8363141d179f0a8a1ffacb8492598101e22a99d1375ae64a4db709eef023d60f","md5":"1a13736242de9a09d7ea3656490f5b7d","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"},{"disposition":"inline","sha256":"c2bdf8e016de7cc07fb65547880e94d77ba4792ffa8be3d89da93117f4895b25","md5":"17e49487c1684da69858367addaf3b6a","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"}],"completelyRewritten":false,"id":"cc58eb48-90a8-62c3-b638-5ca18df8384b","QID":"3tvagqhnkh-1","GUID":"UcHu8RQ61S_a7Y4Wh7yaIh3sXJc0cS3K","sender":"bounces-13009f2b4f-e25654848b@b.cts.vresp.com","recipient":["lgonzalez@wayne.bank"],"senderIP":"105.132.110.207","messageID":"<13009f2b4f-lgonzalez=wayne.bank@mail.vresp.com>"} ::: fileHash=<13009f2b4f-lgonzalez=wayne.bank@mail.vresp.com> ::: fileName=from: bounces-13009f2b4f-e25654848b@b.cts.vresp.com subj: Promo Items - $25 Off Your Next Order, Order Now ::: serverIP=105.132.110.207 ::: emailFrom=bounces-13009f2b4f-e25654848b@b.cts.vresp.com ::: created_at=2023-10-25T15:44:59.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Promo Items - $25 Off Your Next Order, Order Now ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-25T15:44:59.000Z ::: emailSendingServer=105.132.110.207 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: bounces-13009f2b4f-e25654848b@b.cts.vresp.com
emailsendingserver: 74.116.88.134
emailsubject: Promo Items - $25 Off Your Next Order, Order Now
filehash: <13009f2b4f-lgonzalez=calprivate.bank@mail.vresp.com>
filename: from: bounces-13009f2b4f-e25654848b@b.cts.vresp.com subj: Promo Items - $25 Off Your Next Order, Order Now
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-10-25T15:44:59.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 105.132.110.207