WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"f80add900f55706c26f794cfdcc5306b9134850e687a71ed86302345eceada0b","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/f80add900f55706c26f794cfdcc5306b9134850e687a71ed86302345eceada0b","threatTime":"2023-12-25T07:47:00.000Z","threat":"http://ssl.yxjs.work/","campaignID":null,"threatType":"url"},{"threatID":"59959f50aab80c0a0d3c6372aeda327805c3bbc7ab98ccde44321b1c2eabc86a","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/59959f50aab80c0a0d3c6372aeda327805c3bbc7ab98ccde44321b1c2eabc86a","threatTime":"2023-12-12T22:43:47.000Z","threat":"https://ssl.yxjs.work","campaignID":null,"threatType":"url"},{"threatID":"fdbe19d6886c27ded090f2ca7c655787d71f5e0e1961134ad60e654a1a612e45","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/fdbe19d6886c27ded090f2ca7c655787d71f5e0e1961134ad60e654a1a612e45","threatTime":"2023-12-25T07:45:57.000Z","threat":"ssl.yxjs.work/","campaignID":null,"threatType":"url"},{"threatID":"6f93ff23d16f269e42fa9474baa3900819b99d78ae1ccfcec2ecc8a93d1d0919","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/6f93ff23d16f269e42fa9474baa3900819b99d78ae1ccfcec2ecc8a93d1d0919","threatTime":"2023-12-12T22:45:30.000Z","threat":"yxjs.work","campaignID":null,"threatType":"url"},{"threatID":"17dc447493c748dd75c402cb97286f09145ad05bfec523fc3ce7ab59380c8e43","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/17dc447493c748dd75c402cb97286f09145ad05bfec523fc3ce7ab59380c8e43","threatTime":"2023-12-14T11:01:38.000Z","threat":"https://ssl.yxjs.work/","campaignID":null,"threatType":"url"}],"messageTime":"2023-12-16T05:05:07.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"尊敬的pbcapital.com用户","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound","umbrella_from"],"modulesRun":["access","av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":11716,"headerFrom":"<rxrfksrivzdaygq@nl.pbcapital.com>","headerReplyTo":null,"fromAddress":["rxrfksrivzdaygq@nl.pbcapital.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["tsam@pbcapital.com"],"xmailer":"Stgletpo Zzoruvdylh 69.04","messageParts":[{"disposition":"inline","sha256":"1b538190ad79e28d716dacd90f7d2f490a5dba15597e3f2151ed952d8d45e23c","md5":"623bfecc0cde1937b9e8c9fed54de7c5","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"e2bbd621-113c-b024-2163-971c91adbeb6","QID":"3v1552g04c-1","GUID":"fCYol-tXAspw13hvKvknbsOCyFR8AqFP","sender":"rxrfksrivzdaygq@nl.pbcapital.com","recipient":["tsam@pbcapital.com"],"senderIP":"192.236.163.195","messageID":"<5939709656c2dcb82a88d6be0c78b75f@nl.pbcapital.com>"} ::: fileHash=<5939709656c2dcb82a88d6be0c78b75f@nl.pbcapital.com> ::: fileName=from: rxrfksrivzdaygq@nl.pbcapital.com subj: 尊敬的pbcapital.com用户 ::: serverIP=192.236.163.195 ::: emailFrom=rxrfksrivzdaygq@nl.pbcapital.com ::: created_at=2023-12-16T05:05:07.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=尊敬的pbcapital.com用户 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-12-16T05:05:07.000Z ::: emailSendingServer=192.236.163.195 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "rxrfksrivzdaygq@nl.pbcapital.com",
    "emailsendingserver": "222.189.137.237",
    "emailsubject": "\u5c0a\u656c\u7684pbcapital.com\u7528\u6237",
    "filehash": "<5939709656c2dcb82a88d6be0c78b75f@nl.pbcapital.com>",
    "filename": "from: rxrfksrivzdaygq@nl.pbcapital.com subj: \u5c0a\u656c\u7684pbcapital.com\u7528\u6237",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":100,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"f80add900f55706c26f794cfdcc5306b9134850e687a71ed86302345eceada0b\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/f80add900f55706c26f794cfdcc5306b9134850e687a71ed86302345eceada0b\",\"threatTime\":\"2023-12-25T07:47:00.000Z\",\"threat\":\"http://ssl.yxjs.work/\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"59959f50aab80c0a0d3c6372aeda327805c3bbc7ab98ccde44321b1c2eabc86a\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/59959f50aab80c0a0d3c6372aeda327805c3bbc7ab98ccde44321b1c2eabc86a\",\"threatTime\":\"2023-12-12T22:43:47.000Z\",\"threat\":\"https://ssl.yxjs.work\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"fdbe19d6886c27ded090f2ca7c655787d71f5e0e1961134ad60e654a1a612e45\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/fdbe19d6886c27ded090f2ca7c655787d71f5e0e1961134ad60e654a1a612e45\",\"threatTime\":\"2023-12-25T07:45:57.000Z\",\"threat\":\"ssl.yxjs.work/\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"6f93ff23d16f269e42fa9474baa3900819b99d78ae1ccfcec2ecc8a93d1d0919\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/6f93ff23d16f269e42fa9474baa3900819b99d78ae1ccfcec2ecc8a93d1d0919\",\"threatTime\":\"2023-12-12T22:45:30.000Z\",\"threat\":\"yxjs.work\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"17dc447493c748dd75c402cb97286f09145ad05bfec523fc3ce7ab59380c8e43\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/17dc447493c748dd75c402cb97286f09145ad05bfec523fc3ce7ab59380c8e43\",\"threatTime\":\"2023-12-14T11:01:38.000Z\",\"threat\":\"https://ssl.yxjs.work/\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-12-16T05:05:07.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"umbrella_hosted\",\"subject\":\"\u5c0a\u656c\u7684pbcapital.com\u7528\u6237\",\"quarantineFolder\":\"Phish\",\"quarantineRule\":\"inbound_phish\",\"policyRoutes\":[\"default_inbound\",\"umbrella_from\"],\"modulesRun\":[\"access\",\"av\",\"dkimv\",\"spf\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":11716,\"headerFrom\":\"<rxrfksrivzdaygq@nl.pbcapital.com>\",\"headerReplyTo\":null,\"fromAddress\":[\"rxrfksrivzdaygq@nl.pbcapital.com\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"tsam@pbcapital.com\"],\"xmailer\":\"Stgletpo Zzoruvdylh 69.04\",\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"1b538190ad79e28d716dacd90f7d2f490a5dba15597e3f2151ed952d8d45e23c\",\"md5\":\"623bfecc0cde1937b9e8c9fed54de7c5\",\"filename\":\"text.html\",\"sandboxStatus\":null,\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"e2bbd621-113c-b024-2163-971c91adbeb6\",\"QID\":\"3v1552g04c-1\",\"GUID\":\"fCYol-tXAspw13hvKvknbsOCyFR8AqFP\",\"sender\":\"rxrfksrivzdaygq@nl.pbcapital.com\",\"recipient\":[\"tsam@pbcapital.com\"],\"senderIP\":\"192.236.163.195\",\"messageID\":\"<5939709656c2dcb82a88d6be0c78b75f@nl.pbcapital.com>\"} ::: fileHash=<5939709656c2dcb82a88d6be0c78b75f@nl.pbcapital.com> ::: fileName=from: rxrfksrivzdaygq@nl.pbcapital.com subj: \u5c0a\u656c\u7684pbcapital.com\u7528\u6237 ::: serverIP=192.236.163.195 ::: emailFrom=rxrfksrivzdaygq@nl.pbcapital.com ::: created_at=2023-12-16T05:05:07.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=\u5c0a\u656c\u7684pbcapital.com\u7528\u6237 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-12-16T05:05:07.000Z ::: emailSendingServer=192.236.163.195 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-12-16T05:05:07.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "192.236.163.195"
}