WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"c126d276134dcd9086d6761b696853f5860d76f5d5888cb2c6b08cd81759acb8","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/c126d276134dcd9086d6761b696853f5860d76f5d5888cb2c6b08cd81759acb8","threatTime":"2023-10-04T13:07:11.000Z","threat":"ipfs.io/ipfs/bafybeidqeoawdkogghuucdmalnxnklgf3ytytmda4xskryuf7eyatsjuvq","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-05T17:49:43.000Z","impostorScore":0,"malwareScore":0,"cluster":"stark_hosted","subject":"Re: PI Contract Remittance Advice Number BNP695673435","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","spf","spam","dmarc","pdr","urldefense"],"messageSize":221360,"headerFrom":"\"Quickbooks creditcontrol\"<info@ai-studio.us>","headerReplyTo":null,"fromAddress":["info@ai-studio.us"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["bfaustino@stark.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"50fb86254073bac20d4f24dc075ba7466e942cb28b6b16fc8aeedea2dd7e97f1","md5":"157dbcfe77fa9a39c167fef61cc95d17","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"},{"disposition":"attstarked","sha256":"65d9c0d08e9c46bca8a0d4dcd7e678c90d3274cacedcc83127d3971ec5209b14","md5":"9a57c6ae560b89399d4a98e6a9a12e98","filename":"remit.png","sandboxStatus":null,"oContentType":"image/png","contentType":"image/png"}],"completelyRewritten":false,"id":"a2b4c36f-6f07-8500-ad93-3367772c6f9b","QID":"3tefhrt8qu-1","GUID":"8x3f7XMPdxX1LLu2aYK-YEYpL6N4qnhe","sender":"info@ai-studio.us","recipient":["bfaustino@stark.bank"],"senderIP":"232.18.185.207","messageID":"<20231005194941.BF5F8E39969D7A4B@ai-studio.us>"} ::: fileHash=<20231005194941.BF5F8E39969D7A4B@ai-studio.us> ::: fileName=from: info@ai-studio.us subj: Re: PI Contract Remittance Advice Number BNP695673435 ::: serverIP=232.18.185.207 ::: emailFrom=info@ai-studio.us ::: created_at=2023-10-05T17:49:43.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Re: PI Contract Remittance Advice Number BNP695673435 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-05T17:49:43.000Z ::: emailSendingServer=232.18.185.207 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: info@ai-studio.us
emailsendingserver: 45.156.85.35
emailsubject: Re: PI Contract Remittance Advice Number BNP695673435
filehash: <20231005194941.BF5F8E39969D7A4B@ai-studio.us>
filename: from: info@ai-studio.us subj: Re: PI Contract Remittance Advice Number BNP695673435
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-10-05T17:49:43.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 232.18.185.207