WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4","threatTime":"2023-08-29T22:30:30.000Z","threat":"c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4","campaignID":null,"threatType":"attumbrellament"}],"messageTime":"2023-08-29T22:31:33.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM","quarantineFolder":"Attumbrellament Defense","quarantineRule":"threat","policyRoutes":["default_inbound"],"modulesRun":["av","spf","sandbox","spam","dmarc","urldefense"],"messageSize":64324,"headerFrom":"\"AP Inquiries_MAILBOXACCOUNTSPAYABLE@Calprivate\" <stephan.witolla@jobticket.de>","headerReplyTo":null,"fromAddress":["stephan.witolla@jobticket.de"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["security@Calprivate.bank"],"xmailer":null,"messageParts":[{"disposition":"attumbrellaed","sha256":"c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4","md5":"9d613f0f93cda7c1b477392ffdfd7252","filename":"w9&statement_advice_for_umbrella.html","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"},{"disposition":"inline","sha256":"2c70e331ae843595a68283f2fe61b2d0fc2663bf73aa3ff5eb788dd88b884d3b","md5":"04a8c8326c207e11ad625ad34ea4bbdc","filename":"text.html","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"5c7279e3-0777-8f66-3926-f216efc6f7e1","QID":"3sqfsc1d7h-1","GUID":"w2R6kx3kMblgVlxLXZUBG9hTUJBq3wFv","sender":"stephan.witolla@jobticket.de","recipient":["security@umbrella.bank"],"senderIP":"145.75.116.243","messageID":"<169334821164.8788.14712446091347986247@jobticket.de>"} ::: fileHash=<169334821164.8788.14712446091347986247@jobticket.de> ::: fileName=from: stephan.witolla@jobticket.de subj: FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM ::: serverIP=145.75.116.243 ::: emailFrom=stephan.witolla@jobticket.de ::: created_at=2023-08-29T22:31:33.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-08-29T22:31:33.000Z ::: emailSendingServer=145.75.116.243 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "stephan.witolla@jobticket.de",
    "emailsendingserver": "212.227.126.135",
    "emailsubject": "FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM",
    "filehash": "<169334821164.8788.14712446091347986247@jobticket.de>",
    "filename": "from: stephan.witolla@jobticket.de subj: FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4\",\"threatTime\":\"2023-08-29T22:30:30.000Z\",\"threat\":\"c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4\",\"campaignID\":null,\"threatType\":\"attumbrellament\"}],\"messageTime\":\"2023-08-29T22:31:33.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"umbrella_hosted\",\"subject\":\"FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM\",\"quarantineFolder\":\"Attumbrellament Defense\",\"quarantineRule\":\"threat\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"spf\",\"sandbox\",\"spam\",\"dmarc\",\"urldefense\"],\"messageSize\":64324,\"headerFrom\":\"\\\"AP Inquiries_MAILBOXACCOUNTSPAYABLE@Calprivate\\\" <stephan.witolla@jobticket.de>\",\"headerReplyTo\":null,\"fromAddress\":[\"stephan.witolla@jobticket.de\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"security@Calprivate.bank\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"attumbrellaed\",\"sha256\":\"c2a908c9ca86fd2592b470b72aca5809114811a221506c6ce97dabf2065d4bb4\",\"md5\":\"9d613f0f93cda7c1b477392ffdfd7252\",\"filename\":\"w9&statement_advice_for_umbrella.html\",\"sandboxStatus\":\"THREAT\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"inline\",\"sha256\":\"2c70e331ae843595a68283f2fe61b2d0fc2663bf73aa3ff5eb788dd88b884d3b\",\"md5\":\"04a8c8326c207e11ad625ad34ea4bbdc\",\"filename\":\"text.html\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"5c7279e3-0777-8f66-3926-f216efc6f7e1\",\"QID\":\"3sqfsc1d7h-1\",\"GUID\":\"w2R6kx3kMblgVlxLXZUBG9hTUJBq3wFv\",\"sender\":\"stephan.witolla@jobticket.de\",\"recipient\":[\"security@umbrella.bank\"],\"senderIP\":\"145.75.116.243\",\"messageID\":\"<169334821164.8788.14712446091347986247@jobticket.de>\"} ::: fileHash=<169334821164.8788.14712446091347986247@jobticket.de> ::: fileName=from: stephan.witolla@jobticket.de subj: FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM ::: serverIP=145.75.116.243 ::: emailFrom=stephan.witolla@jobticket.de ::: created_at=2023-08-29T22:31:33.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=FW:Statement & w9 -Ref #611198038_on  Tuesday-August-2023 15:30 PM ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-08-29T22:31:33.000Z ::: emailSendingServer=145.75.116.243 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-08-29T22:31:33.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "145.75.116.243"
}