WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"9928e64d5cfa1a4f0ced919dff3d416684b6347e5e00210ca7c4b2dd2c4332a4","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/9928e64d5cfa1a4f0ced919dff3d416684b6347e5e00210ca7c4b2dd2c4332a4","threatTime":"2022-09-06T16:26:22.000Z","threat":"9928e64d5cfa1a4f0ced919dff3d416684b6347e5e00210ca7c4b2dd2c4332a4","campaignID":null,"threatType":"attumbrellament"},{"threatID":"b9a4927017b55c083c4c33c94130428ba2f24268eb486fbbd76a89f4134f74f0","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/b9a4927017b55c083c4c33c94130428ba2f24268eb486fbbd76a89f4134f74f0","threatTime":"2022-09-06T18:29:26.000Z","threat":"https://2001j8ldp4fcupv7c9sbnbfc5sl0l896h453e7kl0t2t5n4lpfairto.siasky.net/","campaignID":null,"threatType":"url"}],"messageTime":"2022-09-06T20:22:38.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"Due Invoice","quarantineFolder":"Attumbrellament Defense","quarantineRule":"threat","policyRoutes":["default_inbound"],"modulesRun":["av","zerohour","dkimv","spf","sandbox","spam","dmarc","pdr","urldefense"],"messageSize":75526,"headerFrom":"\"Broomea\" <sales@docusgn.jp>","headerReplyTo":"sales@docusgn.jp","fromAddress":["sales@docusgn.jp"],"ccAddresses":[],"replyToAddress":["sales@docusgn.jp"],"toAddresses":["mwangsuwana@umbrella.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"066e3a8ed4598b4c89e634d47ff2139ef7888551e3e67ecc41e5f56f673f5379","md5":"248278e94f3e26aa90be0b7cdad5fe4e","filename":"text.html","sandboxStatus":"NOT_SUPPORTED","oContentType":"text/html","contentType":"text/html"},{"disposition":"attumbrellaed","sha256":"9928e64d5cfa1a4f0ced919dff3d416684b6347e5e00210ca7c4b2dd2c4332a4","md5":"2f2898b81795e241832d836f7f07abae","filename":"review important document.pdf","sandboxStatus":"THREAT","oContentType":"application/pdf","contentType":"application/pdf"}],"completelyRewritten":false,"id":"4ab3cb71-d2b0-0dea-f183-cf5d2bdcc2a9","QID":"3jc5afs1mg-1","GUID":"S8eA8fw-NqL405El_JhquDSK_Lrsm_qZ","sender":"sales@docusgn.jp","recipient":["mwangsuwana@umbrella.bank"],"senderIP":"51.242.222.172","messageID":"<3jc5afs1mg-1@m0162926.ppops.net>"} ::: fileHash=<3jc5afs1mg-1@m0162926.ppops.net> ::: fileName=from: sales@docusgn.jp subj: Due Invoice ::: serverIP=51.242.222.172 ::: emailFrom=sales@docusgn.jp ::: created_at=2022-09-06T20:22:38.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Due Invoice ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2022-09-06T20:22:38.000Z ::: emailSendingServer=51.242.222.172 ::: pipelineEntrypoint=dispatch
{
    "emailsubject": "Due Invoice",
    "senderhost": "localhost",
    "severitylabel": "critical",
    "starttimeutc": "2022-09-06T20:22:38.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "productids": [
        32,
        0
    ],
    "filename": "from: sales@docusgn.jp subj: Due Invoice",
    "severitycode": 2,
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":100,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"9928e64d5cfa1a4f0ced919dff3d416684b6347e5e00210ca7c4b2dd2c4332a4\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/9928e64d5cfa1a4f0ced919dff3d416684b6347e5e00210ca7c4b2dd2c4332a4\",\"threatTime\":\"2022-09-06T16:26:22.000Z\",\"threat\":\"9928e64d5cfa1a4f0ced919dff3d416684b6347e5e00210ca7c4b2dd2c4332a4\",\"campaignID\":null,\"threatType\":\"attumbrellament\"},{\"threatID\":\"b9a4927017b55c083c4c33c94130428ba2f24268eb486fbbd76a89f4134f74f0\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/b9a4927017b55c083c4c33c94130428ba2f24268eb486fbbd76a89f4134f74f0\",\"threatTime\":\"2022-09-06T18:29:26.000Z\",\"threat\":\"https://2001j8ldp4fcupv7c9sbnbfc5sl0l896h453e7kl0t2t5n4lpfairto.siasky.net/\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2022-09-06T20:22:38.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"umbrella_hosted\",\"subject\":\"Due Invoice\",\"quarantineFolder\":\"Attumbrellament Defense\",\"quarantineRule\":\"threat\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"zerohour\",\"dkimv\",\"spf\",\"sandbox\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":75526,\"headerFrom\":\"\\\"Broomea\\\" <sales@docusgn.jp>\",\"headerReplyTo\":\"sales@docusgn.jp\",\"fromAddress\":[\"sales@docusgn.jp\"],\"ccAddresses\":[],\"replyToAddress\":[\"sales@docusgn.jp\"],\"toAddresses\":[\"mwangsuwana@umbrella.bank\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"066e3a8ed4598b4c89e634d47ff2139ef7888551e3e67ecc41e5f56f673f5379\",\"md5\":\"248278e94f3e26aa90be0b7cdad5fe4e\",\"filename\":\"text.html\",\"sandboxStatus\":\"NOT_SUPPORTED\",\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"attumbrellaed\",\"sha256\":\"9928e64d5cfa1a4f0ced919dff3d416684b6347e5e00210ca7c4b2dd2c4332a4\",\"md5\":\"2f2898b81795e241832d836f7f07abae\",\"filename\":\"review important document.pdf\",\"sandboxStatus\":\"THREAT\",\"oContentType\":\"application/pdf\",\"contentType\":\"application/pdf\"}],\"completelyRewritten\":false,\"id\":\"4ab3cb71-d2b0-0dea-f183-cf5d2bdcc2a9\",\"QID\":\"3jc5afs1mg-1\",\"GUID\":\"S8eA8fw-NqL405El_JhquDSK_Lrsm_qZ\",\"sender\":\"sales@docusgn.jp\",\"recipient\":[\"mwangsuwana@umbrella.bank\"],\"senderIP\":\"51.242.222.172\",\"messageID\":\"<3jc5afs1mg-1@m0162926.ppops.net>\"} ::: fileHash=<3jc5afs1mg-1@m0162926.ppops.net> ::: fileName=from: sales@docusgn.jp subj: Due Invoice ::: serverIP=51.242.222.172 ::: emailFrom=sales@docusgn.jp ::: created_at=2022-09-06T20:22:38.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Due Invoice ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2022-09-06T20:22:38.000Z ::: emailSendingServer=51.242.222.172 ::: pipelineEntrypoint=dispatch",
    "sensitivity": "normal",
    "emailsendingserver": "156.67.218.149",
    "messagetype": "email_protection_event",
    "emailfrom": "sales@docusgn.jp",
    "sourceinfo": "unknown",
    "filehash": "<3jc5afs1mg-1@m0162926.ppops.net>",
    "vendorcode": "blocked_message",
    "action": "block",
    "streamName": "proofpoint_protect",
    "serverIP": "51.242.222.172"
}