WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"3b67a852e5f8d8af26f1399ab9f06aa21fd9f3720e0c87bb112f7ae8a0424230","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/3b67a852e5f8d8af26f1399ab9f06aa21fd9f3720e0c87bb112f7ae8a0424230","threatTime":"2023-10-02T13:05:43.000Z","threat":"ipfs.io/ipfs/bafybeifirecy3rs7v6zn7slgsj3ukeuoajjzmvom2pmjrgoqae5z4q32na","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-03T02:37:31.000Z","impostorScore":0,"malwareScore":0,"cluster":"stark_hosted","subject":"mwangsuwana@stark.bankyour account has been temporarily suspended","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":6703,"headerFrom":"\"Administrator;stark.bank\"<info@ai-studio.us>","headerReplyTo":"Support Team <info@ai-studio.us>","fromAddress":["info@ai-studio.us"],"ccAddresses":[],"replyToAddress":["93861e61fb0f69b092ace73b427f357c@ai-studio.us>"],"toAddresses":["mwangsuwana@stark.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"33fb0c3cc68c9def894a1d53db05d43692e0561a1e65cd044fe4b0d6a8c8a06a","md5":"becf4363b41983e636e7a21625f69873","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"4826afb1-8215-e2e3-02b5-072a9ea8e579","QID":"3tefhrs17a-1","GUID":"Q4L9iOHACrTxW6q4yJhhDHj2fLx-S7h8","sender":"info@ai-studio.us","recipient":["mwangsuwana@stark.bank"],"senderIP":"148.11.228.138","messageID":"<20231003043730.3012832B5C343999@ai-studio.us>"} ::: fileHash=<20231003043730.3012832B5C343999@ai-studio.us> ::: fileName=from: info@ai-studio.us subj: mwangsuwana@stark.bankyour account has been temporarily suspended ::: serverIP=148.11.228.138 ::: emailFrom=info@ai-studio.us ::: created_at=2023-10-03T02:37:31.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=mwangsuwana@stark.bankyour account has been temporarily suspended ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-03T02:37:31.000Z ::: emailSendingServer=148.11.228.138 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: info@ai-studio.us
emailsendingserver: 134.255.234.231
emailsubject: mwangsuwana@calprivate.bankyour account has been temporarily suspended
filehash: <20231003043730.3012832B5C343999@ai-studio.us>
filename: from: info@ai-studio.us subj: mwangsuwana@calprivate.bankyour account has been temporarily suspended
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-10-03T02:37:31.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 148.11.228.138