WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"3e02d0e1ed619b8b7986eumbrellaa0a69a5232624f7f6e62ca1abd5d26fac2cc95c0","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/3e02d0e1ed619b8b7986eumbrellaa0a69a5232624f7f6e62ca1abd5d26fac2cc95c0","threatTime":"2023-10-02T13:06:21.000Z","threat":"http://ipfs.io/ipfs/bafybeifirecy3rs7v6zn7slgsj3ukeuoajjzmvom2pmjrgoqae5z4q32na","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-02T23:08:05.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"dbanjac@sandiegoprivatebank.netyour account has been temporarily suspended","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":6751,"headerFrom":"\"Administrator;sandiegoprivatebank.net\"<info@ai-studio.us>","headerReplyTo":"Mail Administrator <info@ai-studio.us>","fromAddress":["info@ai-studio.us"],"ccAddresses":[],"replyToAddress":["821f0245c6a2b90e5f760828a0b3c797@ai-studio.us>"],"toAddresses":["dbanjac@sandiegoprivatebank.net"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"d646d7e538aca1a860b786ac139fa35f3e09052049a68c154fb360535538a959","md5":"4a5ab8a5081d5a104ec1c1503f54243b","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"600def25-4b06-2240-f361-e72042722a61","QID":"3tefhrryag-1","GUID":"mHz9bbJsDwSXBEwvrvCuOZaCU7J03W-M","sender":"info@ai-studio.us","recipient":["dbanjac@sandiegoprivatebank.net"],"senderIP":"114.193.229.62","messageID":"<20231003010803.CE3BD6CB8A189F6E@ai-studio.us>"} ::: fileHash=<20231003010803.CE3BD6CB8A189F6E@ai-studio.us> ::: fileName=from: info@ai-studio.us subj: dbanjac@sandiegoprivatebank.netyour account has been temporarily suspended ::: serverIP=114.193.229.62 ::: emailFrom=info@ai-studio.us ::: created_at=2023-10-02T23:08:05.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=dbanjac@sandiegoprivatebank.netyour account has been temporarily suspended ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-02T23:08:05.000Z ::: emailSendingServer=114.193.229.62 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: info@ai-studio.us
emailsendingserver: 134.255.234.231
emailsubject: dbanjac@sandiegoprivatebank.netyour account has been temporarily suspended
filehash: <20231003010803.CE3BD6CB8A189F6E@ai-studio.us>
filename: from: info@ai-studio.us subj: dbanjac@sandiegoprivatebank.netyour account has been temporarily suspended
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-10-02T23:08:05.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 114.193.229.62