WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"6f5562370a32577b17ecf3ef5e7e9f755dea03d42de81ecf13e3eeedb25f574f","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/6f5562370a32577b17ecf3ef5e7e9f755dea03d42de81ecf13e3eeedb25f574f","threatTime":"2023-09-04T06:06:56.000Z","threat":"ipfs.io/ipfs/bafybeidcooplup5sdzzqte2agrpjbtt46qypo3efmzrsftrjntfxdrmfym/nePiopK0.html","campaignID":null,"threatType":"url"},{"threatID":"8de21c29ac417d416ae78cf7319f02d918e5846e32c5ceb3f926b317b162beef","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/8de21c29ac417d416ae78cf7319f02d918e5846e32c5ceb3f926b317b162beef","threatTime":"2023-09-07T09:55:21.000Z","threat":"https://fleek.ipfs.io/ipfs/bafybeidcooplup5sdzzqte2agrpjbtt46qypo3efmzrsftrjntfxdrmfym/nePiopK0.html#kgandolfo@sandiegoprivatebank.net","campaignID":null,"threatType":"url"},{"threatID":"b48b75af6f7ce57a1a5c0307d0cc8d2d8bdf34d222ad180f4396b933a5be13e2","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/b48b75af6f7ce57a1a5c0307d0cc8d2d8bdf34d222ad180f4396b933a5be13e2","threatTime":"2023-09-04T06:08:22.000Z","threat":"http://ipfs.io/ipfs/bafybeidcooplup5sdzzqte2agrpjbtt46qypo3efmzrsftrjntfxdrmfym/nePiopK0.html","campaignID":null,"threatType":"url"}],"messageTime":"2023-09-07T09:53:39.000Z","impostorScore":0,"malwareScore":0,"cluster":"oscorp_hosted","subject":"Password for kgandolfo@sandiegoprivatebank.net expires today 9/7/2023 2:53:36 a.m.","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","spf","spam","dmarc","pdr","urldefense"],"messageSize":6746,"headerFrom":"sandiegoprivatebank.net support <zjxldm@kza.biglobe.ne.jp>","headerReplyTo":null,"fromAddress":["zjxldm@kza.biglobe.ne.jp"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["kgandolfo@sandiegoprivatebank.net"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"64fed39ed13eca9a3c6bc76f65b29b2c2ae74f25b85ab5c5b54db7a989d7fab4","md5":"137c0788dfdf003ee814123295b2e8be","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"3f6cf3a4-33f3-dc75-8bb5-aa468aa1b211","QID":"3sv0wq9wc5-1","GUID":"dJfIaVmmaGnP0WX3nbKI6PqsHDj3hETV","sender":"zjxldm@kza.biglobe.ne.jp","recipient":["kgandolfo@sandiegoprivatebank.net"],"senderIP":"133.161.209.136","messageID":"<20230907025336.CDFAA18EA0F40BC5@kza.biglobe.ne.jp>"} ::: fileHash=<20230907025336.CDFAA18EA0F40BC5@kza.biglobe.ne.jp> ::: fileName=from: zjxldm@kza.biglobe.ne.jp subj: Password for kgandolfo@sandiegoprivatebank.net expires today 9/7/2023 2:53:36 a.m. ::: serverIP=133.161.209.136 ::: emailFrom=zjxldm@kza.biglobe.ne.jp ::: created_at=2023-09-07T09:53:39.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Password for kgandolfo@sandiegoprivatebank.net expires today 9/7/2023 2:53:36 a.m. ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-09-07T09:53:39.000Z ::: emailSendingServer=133.161.209.136 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: zjxldm@kza.biglobe.ne.jp
emailsendingserver: 162.240.147.170
emailsubject: Password for kgandolfo@sandiegoprivatebank.net expires today 9/7/2023 2:53:36 a.m.
filehash: <20230907025336.CDFAA18EA0F40BC5@kza.biglobe.ne.jp>
filename: from: zjxldm@kza.biglobe.ne.jp subj: Password for kgandolfo@sandiegoprivatebank.net expires today 9/7/2023 2:53:36 a.m.
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-09-07T09:53:39.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 133.161.209.136