WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"8132a7efd4e0e682020db800c2cb1bfe1d99a85d0e0e2bf357c6a47cab1e2f9a","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/8132a7efd4e0e682020db800c2cb1bfe1d99a85d0e0e2bf357c6a47cab1e2f9a","threatTime":"2023-10-21T12:11:24.000Z","threat":"https://linkprotect.cudasvc.com/url?a=www.google.gg/amp/s/mailfiles.online/MdHdvcm5oYW1Ac2FuZGllZ29wcml2YXRlYmFuay5uZXQ=&c=E,1,RHmAtRtvh3Xjkp0o9U9OT03Z5NUzzlLucALp_SJJJWR1Xmh6DO7zW9jWv190uL58dEKoYea-eq8iWB29jHY4d9c12Gfz6LOW0fq6nJwuL8O5&typo=0","campaignID":null,"threatType":"url"},{"threatID":"60ac1af21fc95571bfc5e78d3a081b1fdbaeba07e84aa55d6a371eaca4b22066","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/60ac1af21fc95571bfc5e78d3a081b1fdbaeba07e84aa55d6a371eaca4b22066","threatTime":"2023-10-20T23:39:26.000Z","threat":"www.google.gg/amp/s/mailfiles.online/","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-21T12:10:38.000Z","impostorScore":0,"malwareScore":0,"cluster":"oscorp_hosted","subject":"Sandiegoprivatebank Financial Statements 10.23.pdf","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","spf","spam","dmarc","pdr","urldefense"],"messageSize":7631,"headerFrom":"\"Finance shared Financial Statements 10.23.pdf\"\r\n <noreply@hotyoga-caldo.com>","headerReplyTo":null,"fromAddress":["noreply@hotyoga-caldo.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["twornham@sandiegoprivatebank.net"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"3f686cde4c45d6a1635f0b968800dc55cf9b2e043fdf050087ea6fb8710b761f","md5":"bbe6ff11f76031194b7053cb2ab7f125","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"2d007571-69eb-e5f5-2e62-674584c9b8e9","QID":"3tvagqg1q6-1","GUID":"PRR03G6mGb286FOVJDonoGYnke19ODIs","sender":"noreply@hotyoga-caldo.com","recipient":["twornham@sandiegoprivatebank.net"],"senderIP":"95.30.75.171","messageID":"<5e401aa9-ccac-7c06-ef27-5747b6cb6f1b@hotyoga-caldo.com>"} ::: fileHash=<5e401aa9-ccac-7c06-ef27-5747b6cb6f1b@hotyoga-caldo.com> ::: fileName=from: noreply@hotyoga-caldo.com subj: Sandiegoprivatebank Financial Statements 10.23.pdf ::: serverIP=95.30.75.171 ::: emailFrom=noreply@hotyoga-caldo.com ::: created_at=2023-10-21T12:10:38.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Sandiegoprivatebank Financial Statements 10.23.pdf ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-21T12:10:38.000Z ::: emailSendingServer=95.30.75.171 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "noreply@hotyoga-caldo.com",
    "emailsendingserver": "150.60.29.210",
    "emailsubject": "Sandiegoprivatebank Financial Statements 10.23.pdf",
    "filehash": "<5e401aa9-ccac-7c06-ef27-5747b6cb6f1b@hotyoga-caldo.com>",
    "filename": "from: noreply@hotyoga-caldo.com subj: Sandiegoprivatebank Financial Statements 10.23.pdf",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":100,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"8132a7efd4e0e682020db800c2cb1bfe1d99a85d0e0e2bf357c6a47cab1e2f9a\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/8132a7efd4e0e682020db800c2cb1bfe1d99a85d0e0e2bf357c6a47cab1e2f9a\",\"threatTime\":\"2023-10-21T12:11:24.000Z\",\"threat\":\"https://linkprotect.cudasvc.com/url?a=www.google.gg/amp/s/mailfiles.online/MdHdvcm5oYW1Ac2FuZGllZ29wcml2YXRlYmFuay5uZXQ=&c=E,1,RHmAtRtvh3Xjkp0o9U9OT03Z5NUzzlLucALp_SJJJWR1Xmh6DO7zW9jWv190uL58dEKoYea-eq8iWB29jHY4d9c12Gfz6LOW0fq6nJwuL8O5&typo=0\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"60ac1af21fc95571bfc5e78d3a081b1fdbaeba07e84aa55d6a371eaca4b22066\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/60ac1af21fc95571bfc5e78d3a081b1fdbaeba07e84aa55d6a371eaca4b22066\",\"threatTime\":\"2023-10-20T23:39:26.000Z\",\"threat\":\"www.google.gg/amp/s/mailfiles.online/\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-10-21T12:10:38.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"oscorp_hosted\",\"subject\":\"Sandiegoprivatebank Financial Statements 10.23.pdf\",\"quarantineFolder\":\"Phish\",\"quarantineRule\":\"inbound_phish\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"spf\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":7631,\"headerFrom\":\"\\\"Finance shared Financial Statements 10.23.pdf\\\"\\r\\n <noreply@hotyoga-caldo.com>\",\"headerReplyTo\":null,\"fromAddress\":[\"noreply@hotyoga-caldo.com\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"twornham@sandiegoprivatebank.net\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"3f686cde4c45d6a1635f0b968800dc55cf9b2e043fdf050087ea6fb8710b761f\",\"md5\":\"bbe6ff11f76031194b7053cb2ab7f125\",\"filename\":\"text.html\",\"sandboxStatus\":null,\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"2d007571-69eb-e5f5-2e62-674584c9b8e9\",\"QID\":\"3tvagqg1q6-1\",\"GUID\":\"PRR03G6mGb286FOVJDonoGYnke19ODIs\",\"sender\":\"noreply@hotyoga-caldo.com\",\"recipient\":[\"twornham@sandiegoprivatebank.net\"],\"senderIP\":\"95.30.75.171\",\"messageID\":\"<5e401aa9-ccac-7c06-ef27-5747b6cb6f1b@hotyoga-caldo.com>\"} ::: fileHash=<5e401aa9-ccac-7c06-ef27-5747b6cb6f1b@hotyoga-caldo.com> ::: fileName=from: noreply@hotyoga-caldo.com subj: Sandiegoprivatebank Financial Statements 10.23.pdf ::: serverIP=95.30.75.171 ::: emailFrom=noreply@hotyoga-caldo.com ::: created_at=2023-10-21T12:10:38.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Sandiegoprivatebank Financial Statements 10.23.pdf ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-21T12:10:38.000Z ::: emailSendingServer=95.30.75.171 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-10-21T12:10:38.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "95.30.75.171"
}