WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"f9b4c5d3b2bae1a7896201084deade4b966240c315642533f5c38699331e25b5","threatStatus":"active","classification":"impostor","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/f9b4c5d3b2bae1a7896201084deade4b966240c315642533f5c38699331e25b5","threatTime":"2023-09-18T20:10:53.000Z","threat":"tuan@trypointai.com:UyekJvgv2uAcomJnRBXnJt8n-NTAEbJa","campaignID":null,"threatType":"messageText"}],"messageTime":"2023-09-18T20:10:52.000Z","impostorScore":100,"malwareScore":0,"cluster":"wayne_hosted","subject":"Re: Turn A.I. into profit (founder with interesting product)","quarantineFolder":"Impostor","quarantineRule":"inbound_impostor","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":9050,"headerFrom":"Tuan Ho <tuan@trypointai.com>","headerReplyTo":null,"fromAddress":["tuan@trypointai.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["cbirkmann@wayne.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"ce98871f9cd90d7f6489a4fc540f3c5d5554e2bf670f7393aca180993348abbe","md5":"e259d1f3f4d33392d6df2d677fb0652f","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"},{"disposition":"inline","sha256":"29a06a3b12f91ce599b30c71c1fb0a5a43df998b94f4c56d7c5234b8917ddc4e","md5":"471ae640ec0c6362adb5d36d9a2123a9","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"3de2e4a6-5722-d6b7-ffd1-7bca03d2773b","QID":"3t5arcgue9-1","GUID":"UyekJvgv2uAcomJnRBXnJt8n-NTAEbJa","sender":"msprvs1=19625bj7onfxp=bounces-320008@spmailtechnol.com","recipient":["cbirkmann@wayne.bank"],"senderIP":"160.145.179.208","messageID":"<fcf81a8cc77940cdb20318c0e032717c_CAE7vk8CJL08kn5YkOj-eASA_hZWQH1MO+6x6gvDsF5+tjSjVmA@mail.gmail.com>"} ::: fileHash=<fcf81a8cc77940cdb20318c0e032717c_CAE7vk8CJL08kn5YkOj-eASA_hZWQH1MO+6x6gvDsF5+tjSjVmA@mail.gmail.com> ::: fileName=from: msprvs1=19625bj7onfxp=bounces-320008@spmailtechnol.com subj: Re: Turn A.I. into profit (founder with interesting product) ::: serverIP=160.145.179.208 ::: emailFrom=msprvs1=19625bj7onfxp=bounces-320008@spmailtechnol.com ::: created_at=2023-09-18T20:10:52.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Re: Turn A.I. into profit (founder with interesting product) ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-09-18T20:10:52.000Z ::: emailSendingServer=160.145.179.208 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "msprvs1=19625bj7onfxp=bounces-320008@spmailtechnol.com",
    "emailsendingserver": "156.70.120.241",
    "emailsubject": "Re: Turn A.I. into profit (founder with interesting product)",
    "filehash": "<fcf81a8cc77940cdb20318c0e032717c_CAE7vk8CJL08kn5YkOj-eASA_hZWQH1MO+6x6gvDsF5+tjSjVmA@mail.gmail.com>",
    "filename": "from: msprvs1=19625bj7onfxp=bounces-320008@spmailtechnol.com subj: Re: Turn A.I. into profit (founder with interesting product)",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":0,\"threatsInfoMap\":[{\"threatID\":\"f9b4c5d3b2bae1a7896201084deade4b966240c315642533f5c38699331e25b5\",\"threatStatus\":\"active\",\"classification\":\"impostor\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/f9b4c5d3b2bae1a7896201084deade4b966240c315642533f5c38699331e25b5\",\"threatTime\":\"2023-09-18T20:10:53.000Z\",\"threat\":\"tuan@trypointai.com:UyekJvgv2uAcomJnRBXnJt8n-NTAEbJa\",\"campaignID\":null,\"threatType\":\"messageText\"}],\"messageTime\":\"2023-09-18T20:10:52.000Z\",\"impostorScore\":100,\"malwareScore\":0,\"cluster\":\"wayne_hosted\",\"subject\":\"Re: Turn A.I. into profit (founder with interesting product)\",\"quarantineFolder\":\"Impostor\",\"quarantineRule\":\"inbound_impostor\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"dkimv\",\"spf\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":9050,\"headerFrom\":\"Tuan Ho <tuan@trypointai.com>\",\"headerReplyTo\":null,\"fromAddress\":[\"tuan@trypointai.com\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"cbirkmann@wayne.bank\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"ce98871f9cd90d7f6489a4fc540f3c5d5554e2bf670f7393aca180993348abbe\",\"md5\":\"e259d1f3f4d33392d6df2d677fb0652f\",\"filename\":\"text.txt\",\"sandboxStatus\":null,\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"},{\"disposition\":\"inline\",\"sha256\":\"29a06a3b12f91ce599b30c71c1fb0a5a43df998b94f4c56d7c5234b8917ddc4e\",\"md5\":\"471ae640ec0c6362adb5d36d9a2123a9\",\"filename\":\"text.html\",\"sandboxStatus\":null,\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"3de2e4a6-5722-d6b7-ffd1-7bca03d2773b\",\"QID\":\"3t5arcgue9-1\",\"GUID\":\"UyekJvgv2uAcomJnRBXnJt8n-NTAEbJa\",\"sender\":\"msprvs1=19625bj7onfxp=bounces-320008@spmailtechnol.com\",\"recipient\":[\"cbirkmann@wayne.bank\"],\"senderIP\":\"160.145.179.208\",\"messageID\":\"<fcf81a8cc77940cdb20318c0e032717c_CAE7vk8CJL08kn5YkOj-eASA_hZWQH1MO+6x6gvDsF5+tjSjVmA@mail.gmail.com>\"} ::: fileHash=<fcf81a8cc77940cdb20318c0e032717c_CAE7vk8CJL08kn5YkOj-eASA_hZWQH1MO+6x6gvDsF5+tjSjVmA@mail.gmail.com> ::: fileName=from: msprvs1=19625bj7onfxp=bounces-320008@spmailtechnol.com subj: Re: Turn A.I. into profit (founder with interesting product) ::: serverIP=160.145.179.208 ::: emailFrom=msprvs1=19625bj7onfxp=bounces-320008@spmailtechnol.com ::: created_at=2023-09-18T20:10:52.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Re: Turn A.I. into profit (founder with interesting product) ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-09-18T20:10:52.000Z ::: emailSendingServer=160.145.179.208 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-09-18T20:10:52.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "160.145.179.208"
}