WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"f80add900f55706c26f794cfdcc5306b9134850e687a71ed86302345eceada0b","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/f80add900f55706c26f794cfdcc5306b9134850e687a71ed86302345eceada0b","threatTime":"2023-12-25T07:47:00.000Z","threat":"http://ssl.yxjs.work/","campaignID":null,"threatType":"url"},{"threatID":"59959f50aab80c0a0d3c6372aeda327805c3bbc7ab98ccde44321b1c2eabc86a","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/59959f50aab80c0a0d3c6372aeda327805c3bbc7ab98ccde44321b1c2eabc86a","threatTime":"2023-12-12T22:43:47.000Z","threat":"https://ssl.yxjs.work","campaignID":null,"threatType":"url"},{"threatID":"fdbe19d6886c27ded090f2ca7c655787d71f5e0e1961134ad60e654a1a612e45","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/fdbe19d6886c27ded090f2ca7c655787d71f5e0e1961134ad60e654a1a612e45","threatTime":"2023-12-25T07:45:57.000Z","threat":"ssl.yxjs.work/","campaignID":null,"threatType":"url"},{"threatID":"6f93ff23d16f269e42fa9474baa3900819b99d78ae1ccfcec2ecc8a93d1d0919","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/6f93ff23d16f269e42fa9474baa3900819b99d78ae1ccfcec2ecc8a93d1d0919","threatTime":"2023-12-12T22:45:30.000Z","threat":"yxjs.work","campaignID":null,"threatType":"url"},{"threatID":"17dc447493c748dd75c402cb97286f09145ad05bfec523fc3ce7ab59380c8e43","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/17dc447493c748dd75c402cb97286f09145ad05bfec523fc3ce7ab59380c8e43","threatTime":"2023-12-14T11:01:38.000Z","threat":"https://ssl.yxjs.work/","campaignID":null,"threatType":"url"}],"messageTime":"2023-12-16T05:05:07.000Z","impostorScore":0,"malwareScore":0,"cluster":"oscorp_hosted","subject":"尊敬的pbcapital.com用户","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound","oscorp_from"],"modulesRun":["access","av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":11716,"headerFrom":"<rxrfksrivzdaygq@nl.pbcapital.com>","headerReplyTo":null,"fromAddress":["rxrfksrivzdaygq@nl.pbcapital.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["tsam@pbcapital.com"],"xmailer":"Stgletpo Zzoruvdylh 69.04","messageParts":[{"disposition":"inline","sha256":"1b538190ad79e28d716dacd90f7d2f490a5dba15597e3f2151ed952d8d45e23c","md5":"623bfecc0cde1937b9e8c9fed54de7c5","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"e2bbd621-113c-b024-2163-971c91adbeb6","QID":"3v1552g04c-1","GUID":"fCYol-tXAspw13hvKvknbsOCyFR8AqFP","sender":"rxrfksrivzdaygq@nl.pbcapital.com","recipient":["tsam@pbcapital.com"],"senderIP":"31.36.237.75","messageID":"<5939709656c2dcb82a88d6be0c78b75f@nl.pbcapital.com>"} ::: fileHash=<5939709656c2dcb82a88d6be0c78b75f@nl.pbcapital.com> ::: fileName=from: rxrfksrivzdaygq@nl.pbcapital.com subj: 尊敬的pbcapital.com用户 ::: serverIP=31.36.237.75 ::: emailFrom=rxrfksrivzdaygq@nl.pbcapital.com ::: created_at=2023-12-16T05:05:07.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=尊敬的pbcapital.com用户 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-12-16T05:05:07.000Z ::: emailSendingServer=31.36.237.75 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: rxrfksrivzdaygq@nl.pbcapital.com
emailsendingserver: 222.189.137.237
emailsubject: 尊敬的pbcapital.com用户
filehash: <5939709656c2dcb82a88d6be0c78b75f@nl.pbcapital.com>
filename: from: rxrfksrivzdaygq@nl.pbcapital.com subj: 尊敬的pbcapital.com用户
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-12-16T05:05:07.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 31.36.237.75