WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"89c082535047e4b612dd0f6619959c8600937b9ce3e5eaa830d375cfb9c07657","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/89c082535047e4b612dd0f6619959c8600937b9ce3e5eaa830d375cfb9c07657","threatTime":"2023-07-25T00:54:07.000Z","threat":"https://mailnet2data.gpisoftware.com/clic?t=53650&e=mldevillers@mp2-cs.com&l=https://thetopography.ca/mon/day//fexrik/dHdvcm5oYW1Ac2FuZGllZ29wcml2YXRlYmFuay5uZXQ=","campaignID":null,"threatType":"url"},{"threatID":"851d9927d7ff36c7009621fd28af286d567815501087a3bbbd04bdb08d49c403","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/851d9927d7ff36c7009621fd28af286d567815501087a3bbbd04bdb08d49c403","threatTime":"2023-07-25T00:53:59.000Z","threat":"https://mailnet2data.gpisoftware.com/clic?t=53650&e=mldevillers@mp2-cs.com&l=https://thetopography.ca/mon/day//lpzhpy/dHdvcm5oYW1Ac2FuZGllZ29wcml2YXRlYmFuay5uZXQ=","campaignID":null,"threatType":"url"}],"messageTime":"2023-07-25T00:53:05.000Z","impostorScore":0,"malwareScore":0,"cluster":"wayne_hosted","subject":"Reminder: Action needed for Sandiegoprivatebank","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound","allow_relay"],"modulesRun":["av","dkimv","spf","spam","dmarc","urldefense"],"messageSize":19226,"headerFrom":"\"Server Authenticator\" <aldo@morbexautomation.com>","headerReplyTo":null,"fromAddress":["aldo@morbexautomation.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["twornham@sandiegoprivatebank.net"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"c68ca51360e7a31951ba6071bf49664928e522f9c8c6a4ddb0a08c0758672006","md5":"5115562031761b7c91ecd463fc9cab34","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"},{"disposition":"inline","sha256":"55990dc6930995d80d3be41c834c29af8f1d1c2843371af2cce2c7a7fd62cc1f","md5":"ce19f785bb6cc85d1687d85ef94490a5","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"c7e8da4f-606d-b89c-364d-8028785042f9","QID":"3s0ayq8tr9-1","GUID":"pI4IY3PnYHlFmqYHXghwZgfZVgmkdPaS","sender":"aldo@morbexautomation.com","recipient":["twornham@sandiegoprivatebank.net"],"senderIP":"85.25.212.179","messageID":"<20232407175259D4B2639621-0F119D63A7@morbexautomation.com>"} ::: fileHash=<20232407175259D4B2639621-0F119D63A7@morbexautomation.com> ::: fileName=from: aldo@morbexautomation.com subj: Reminder: Action needed for Sandiegoprivatebank ::: serverIP=85.25.212.179 ::: emailFrom=aldo@morbexautomation.com ::: created_at=2023-07-25T00:53:05.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Reminder: Action needed for Sandiegoprivatebank ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-07-25T00:53:05.000Z ::: emailSendingServer=85.25.212.179 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "aldo@morbexautomation.com",
    "emailsendingserver": "40.107.237.120",
    "emailsubject": "Reminder: Action needed for Sandiegoprivatebank",
    "filehash": "<20232407175259D4B2639621-0F119D63A7@morbexautomation.com>",
    "filename": "from: aldo@morbexautomation.com subj: Reminder: Action needed for Sandiegoprivatebank",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"89c082535047e4b612dd0f6619959c8600937b9ce3e5eaa830d375cfb9c07657\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/89c082535047e4b612dd0f6619959c8600937b9ce3e5eaa830d375cfb9c07657\",\"threatTime\":\"2023-07-25T00:54:07.000Z\",\"threat\":\"https://mailnet2data.gpisoftware.com/clic?t=53650&e=mldevillers@mp2-cs.com&l=https://thetopography.ca/mon/day//fexrik/dHdvcm5oYW1Ac2FuZGllZ29wcml2YXRlYmFuay5uZXQ=\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"851d9927d7ff36c7009621fd28af286d567815501087a3bbbd04bdb08d49c403\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/851d9927d7ff36c7009621fd28af286d567815501087a3bbbd04bdb08d49c403\",\"threatTime\":\"2023-07-25T00:53:59.000Z\",\"threat\":\"https://mailnet2data.gpisoftware.com/clic?t=53650&e=mldevillers@mp2-cs.com&l=https://thetopography.ca/mon/day//lpzhpy/dHdvcm5oYW1Ac2FuZGllZ29wcml2YXRlYmFuay5uZXQ=\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-07-25T00:53:05.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"wayne_hosted\",\"subject\":\"Reminder: Action needed for Sandiegoprivatebank\",\"quarantineFolder\":\"Phish\",\"quarantineRule\":\"inbound_phish\",\"policyRoutes\":[\"default_inbound\",\"allow_relay\"],\"modulesRun\":[\"av\",\"dkimv\",\"spf\",\"spam\",\"dmarc\",\"urldefense\"],\"messageSize\":19226,\"headerFrom\":\"\\\"Server Authenticator\\\" <aldo@morbexautomation.com>\",\"headerReplyTo\":null,\"fromAddress\":[\"aldo@morbexautomation.com\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"twornham@sandiegoprivatebank.net\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"c68ca51360e7a31951ba6071bf49664928e522f9c8c6a4ddb0a08c0758672006\",\"md5\":\"5115562031761b7c91ecd463fc9cab34\",\"filename\":\"text.txt\",\"sandboxStatus\":null,\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"},{\"disposition\":\"inline\",\"sha256\":\"55990dc6930995d80d3be41c834c29af8f1d1c2843371af2cce2c7a7fd62cc1f\",\"md5\":\"ce19f785bb6cc85d1687d85ef94490a5\",\"filename\":\"text.html\",\"sandboxStatus\":null,\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"c7e8da4f-606d-b89c-364d-8028785042f9\",\"QID\":\"3s0ayq8tr9-1\",\"GUID\":\"pI4IY3PnYHlFmqYHXghwZgfZVgmkdPaS\",\"sender\":\"aldo@morbexautomation.com\",\"recipient\":[\"twornham@sandiegoprivatebank.net\"],\"senderIP\":\"85.25.212.179\",\"messageID\":\"<20232407175259D4B2639621-0F119D63A7@morbexautomation.com>\"} ::: fileHash=<20232407175259D4B2639621-0F119D63A7@morbexautomation.com> ::: fileName=from: aldo@morbexautomation.com subj: Reminder: Action needed for Sandiegoprivatebank ::: serverIP=85.25.212.179 ::: emailFrom=aldo@morbexautomation.com ::: created_at=2023-07-25T00:53:05.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Reminder: Action needed for Sandiegoprivatebank ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-07-25T00:53:05.000Z ::: emailSendingServer=85.25.212.179 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-07-25T00:53:05.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "85.25.212.179"
}