WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"54e7b32779a52bda4317f1f463ba395b80fe24fd4d757bdf9cde18a87ba03cbe","threatStatus":"active","classification":"impostor","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/54e7b32779a52bda4317f1f463ba395b80fe24fd4d757bdf9cde18a87ba03cbe","threatTime":"2023-12-21T08:44:42.000Z","threat":"khalifah@aramcosupply-uae.com:Afl8LmHOc8BhLlGYSVsMLBunSe81JCX0","campaignID":null,"threatType":"messageText"}],"messageTime":"2023-12-21T08:44:41.000Z","impostorScore":100,"malwareScore":0,"cluster":"umbrella_hosted","subject":"VENDOR EXPRESSION OF INTEREST","quarantineFolder":"Impostor","quarantineRule":"inbound_impostor","policyRoutes":["default_inbound"],"modulesRun":["av","spf","spam","dmarc","pdr","urldefense"],"messageSize":2119,"headerFrom":"\".ARAMCO UAE (SAUDI ARAMCO)\" <zoom@onclinic.com.ua>","headerReplyTo":"khalifah@aramcosupply-uae.com","fromAddress":["zoom@onclinic.com.ua"],"ccAddresses":[],"replyToAddress":["db8179a66bfc2012fb248e3640e24591@aramcosupply-uae.com"],"toAddresses":["zoom@onclinic.com.ua"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"381714dc9968e9dafd2074ac2923175e035d7968dca6d9d7e6353f3012a3ce5f","md5":"b7da8efbac440f3e8a12a153cf63c8d4","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"}],"completelyRewritten":false,"id":"ef72231e-ae69-5cc8-5532-9f906dab506b","QID":"3v1b5fj0mk-1","GUID":"Afl8LmHOc8BhLlGYSVsMLBunSe81JCX0","sender":"zoom@onclinic.com.ua","recipient":["kgandolfo@sandiegoprivatebank.net"],"senderIP":"196.189.90.249","messageID":"<20231221035535.B4D61168C14@mail.onclinic.com.ua>"} ::: fileHash=<20231221035535.B4D61168C14@mail.onclinic.com.ua> ::: fileName=from: zoom@onclinic.com.ua subj: VENDOR EXPRESSION OF INTEREST ::: serverIP=196.189.90.249 ::: emailFrom=zoom@onclinic.com.ua ::: created_at=2023-12-21T08:44:41.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=VENDOR EXPRESSION OF INTEREST ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-12-21T08:44:41.000Z ::: emailSendingServer=196.189.90.249 ::: pipelineEntrypoint=dispatch
Product: Protect
Vendor: ProofPoint