WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"ad080999be9f277cc9fa743a85c4223561223a4e2c45cdfdc148ce33c9fa7ba3","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/ad080999be9f277cc9fa743a85c4223561223a4e2c45cdfdc148ce33c9fa7ba3","threatTime":"2022-11-10T16:13:26.000Z","threat":"ad080999be9f277cc9fa743a85c4223561223a4e2c45cdfdc148ce33c9fa7ba3","campaignID":null,"threatType":"attoscorpment"}],"messageTime":"2022-11-10T16:14:40.000Z","impostorScore":0,"malwareScore":0,"cluster":"oscorp_hosted","subject":"1 miss call received on 11/10/2022 (GMT+08:30)","quarantineFolder":"Attoscorpment Defense","quarantineRule":"threat","policyRoutes":["default_inbound"],"modulesRun":["av","zerohour","spf","sandbox","spam","dmarc","urldefense"],"messageSize":2924,"headerFrom":"Calprivate|V-Mail™ ☎®\r\n\t<sanda.emini@rav.org.rs>","headerReplyTo":null,"fromAddress":["sanda.emini@rav.org.rs"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["amasembe@oscorp.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"ad080999be9f277cc9fa743a85c4223561223a4e2c45cdfdc148ce33c9fa7ba3","md5":"d0ee0e91ade64555753dddb802da771a","filename":"☎®voice042456432-121_076_454656_3-2(4).html","sandboxStatus":"THREAT","oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"dc6b19d1-e186-a1ee-cb13-0a0d8dd4f27c","QID":"3knkpuhxmg-1","GUID":"bbVki-ULS08rh3wb2AO_PWiAkO8Iqgl5","sender":"sanda.emini@rav.org.rs","recipient":["amasembe@oscorp.bank"],"senderIP":"88.43.207.207","messageID":"<5e9f4489-7c2d-5068-7b07-e11f1a9d3f5e@rav.org.rs>"} ::: fileHash=<5e9f4489-7c2d-5068-7b07-e11f1a9d3f5e@rav.org.rs> ::: fileName=from: sanda.emini@rav.org.rs subj: 1 miss call received on 11/10/2022 (GMT+08:30) ::: serverIP=88.43.207.207 ::: emailFrom=sanda.emini@rav.org.rs ::: created_at=2022-11-10T16:14:40.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=1 miss call received on 11/10/2022 (GMT+08:30) ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2022-11-10T16:14:40.000Z ::: emailSendingServer=88.43.207.207 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
emailsubject: 1 miss call received on 11/10/2022 (GMT+08:30)
senderhost: localhost
severitylabel: critical
starttimeutc: 2022-11-10T16:14:40.000Z
tags: ['proofpoint_protect', 'email_protection_event']
productids: [32, 0]
filename: from: sanda.emini@rav.org.rs subj: 1 miss call received on 11/10/2022 (GMT+08:30)
severitycode: 2
sensitivity: normal
emailsendingserver: 217.26.214.71
messagetype: email_protection_event
emailfrom: sanda.emini@rav.org.rs
sourceinfo: unknown
filehash: <5e9f4489-7c2d-5068-7b07-e11f1a9d3f5e@rav.org.rs>
vendorcode: blocked_message
action: block
streamName: proofpoint_protect
serverIP: 88.43.207.207