WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"122bf48b7a7e0b5cc3526364ef01e99c28b37d0a6b0ac426dacme0fdfb0a3a13d","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/122bf48b7a7e0b5cc3526364ef01e99c28b37d0a6b0ac426dacme0fdfb0a3a13d","threatTime":"2023-10-21T12:12:07.000Z","threat":"https://linkprotect.cudasvc.com/url?a=www.google.gg/amp/s/mailfiles.online/MdHdvcm5oYW1AY2FscHJpdmF0ZS5iYW5r&c=E,1,RHmAtRtvh3Xjkp0o9U9OT03Z5NUzzlLucALp_SJJJWR1Xmh6DO7zW9jWv190uL58dEKoYea-eq8iWB29jHY4d9c12Gfz6LOW0fq6nJwuL8O5&typo=0","campaignID":null,"threatType":"url"},{"threatID":"60ac1af21fc95571bfc5e78d3a081b1fdbaeba07e84aa55d6a371eaca4b22066","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/60ac1af21fc95571bfc5e78d3a081b1fdbaeba07e84aa55d6a371eaca4b22066","threatTime":"2023-10-20T23:39:26.000Z","threat":"www.google.gg/amp/s/mailfiles.online/","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-21T12:10:41.000Z","impostorScore":0,"malwareScore":0,"cluster":"acme_hosted","subject":"Calprivate Financial Statements 10.23.pdf","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","spf","spam","dmarc","pdr","urldefense"],"messageSize":7556,"headerFrom":"\"Finance shared Financial Statements 10.23.pdf\"\r\n <noreply@hotyoga-caldo.com>","headerReplyTo":null,"fromAddress":["noreply@hotyoga-caldo.com"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["twornham@acme.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"40a5eef7b8c5817b7cda7f60cade39001e025690605d9b363df7ae9419cfe492","md5":"d8f94ee91f9b148858462511f8f1afac","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"ceebb969-af14-c89c-683b-9bdb38c4132b","QID":"3tvd1d00kw-1","GUID":"AVjcHLvOGxHxeYzDpDyDImtpKNlHw9ZX","sender":"noreply@hotyoga-caldo.com","recipient":["twornham@acme.bank"],"senderIP":"66.0.19.232","messageID":"<4866a2d9-3f77-da70-6f29-35c936304341@hotyoga-caldo.com>"} ::: fileHash=<4866a2d9-3f77-da70-6f29-35c936304341@hotyoga-caldo.com> ::: fileName=from: noreply@hotyoga-caldo.com subj: Calprivate Financial Statements 10.23.pdf ::: serverIP=66.0.19.232 ::: emailFrom=noreply@hotyoga-caldo.com ::: created_at=2023-10-21T12:10:41.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Calprivate Financial Statements 10.23.pdf ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-21T12:10:41.000Z ::: emailSendingServer=66.0.19.232 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: noreply@hotyoga-caldo.com
emailsendingserver: 150.60.29.210
emailsubject: Calprivate Financial Statements 10.23.pdf
filehash: <4866a2d9-3f77-da70-6f29-35c936304341@hotyoga-caldo.com>
filename: from: noreply@hotyoga-caldo.com subj: Calprivate Financial Statements 10.23.pdf
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-10-21T12:10:41.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 66.0.19.232