WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":100,"threatsInfoMap":[{"threatID":"eeb928029439291630d698e16b3aa8dba53b007156a008a179e58cd0ba0cd0a0","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/eeb928029439291630d698e16b3aa8dba53b007156a008a179e58cd0ba0cd0a0","threatTime":"2023-08-22T10:58:36.000Z","threat":"365firs-gov.com","campaignID":null,"threatType":"url"},{"threatID":"d95178827407fdcca18ae3fc2fd91ce57ef91bb0b9853a1b95243e35cc804710","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/d95178827407fdcca18ae3fc2fd91ce57ef91bb0b9853a1b95243e35cc804710","threatTime":"2023-08-22T10:09:47.000Z","threat":"myworld.1577602.com/dashingdayszs/","campaignID":null,"threatType":"url"},{"threatID":"5835eeeaa4656bf08b929c95946633288b443d3182ae33fc3b9a589b64c97917","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/5835eeeaa4656bf08b929c95946633288b443d3182ae33fc3b9a589b64c97917","threatTime":"2023-08-22T10:28:12.000Z","threat":"url1451.365firs-gov.com/ls/","campaignID":null,"threatType":"url"},{"threatID":"afaa373e4c67bde0297e13d1613acbd4f5ca6fc91316150940712001769374d3","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/afaa373e4c67bde0297e13d1613acbd4f5ca6fc91316150940712001769374d3","threatTime":"2023-08-22T10:25:40.000Z","threat":"url1451.365firs-gov.com/ls/click","campaignID":null,"threatType":"url"}],"messageTime":"2023-08-22T10:05:36.000Z","impostorScore":0,"malwareScore":0,"cluster":"acme_hosted","subject":"Invoice processing error for  CalPrivate Bank; POC: Mag Wangsuwana.","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":118843,"headerFrom":"Microsoft W9/FEIN <submit@365firs-gov.com>","headerReplyTo":"submit@365firs-gov.com","fromAddress":["submit@365firs-gov.com"],"ccAddresses":[],"replyToAddress":["submit@365firs-gov.com"],"toAddresses":["mwangsuwana@acme.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"6dcdbb6bf85dccfb402eb3defd1b043944a7a71c5ae0763d6c31c2ff1d49fbf4","md5":"a231f043f79813c04483fc70cc27114d","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"},{"disposition":"inline","sha256":"31d85c4789ce9962677936970c978f9374b952ddbc80f06b3ec0aa6114c48840","md5":"b42b2bcf0db41adcee91794cdb8d8a53","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"433e309a-ee7d-d842-a590-a99619884782","QID":"3skwt3rjby-1","GUID":"tT0q8SK_SM-h1Cj-PLN549TC1q-yRPBq","sender":"bounces+36719643-009a-mwangsuwana=acme.bank@em9386.365firs-gov.com","recipient":["mwangsuwana@acme.bank"],"senderIP":"101.73.243.17","messageID":"<ebJI_aIQQjiVw4xIz9Sj7g@geopod-ismtpd-15>"} ::: fileHash=<ebJI_aIQQjiVw4xIz9Sj7g@geopod-ismtpd-15> ::: fileName=from: bounces+36719643-009a-mwangsuwana=acme.bank@em9386.365firs-gov.com subj: Invoice processing error for  CalPrivate Bank; POC: Mag Wangsuwana. ::: serverIP=101.73.243.17 ::: emailFrom=bounces+36719643-009a-mwangsuwana=acme.bank@em9386.365firs-gov.com ::: created_at=2023-08-22T10:05:36.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Invoice processing error for  CalPrivate Bank; POC: Mag Wangsuwana. ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-08-22T10:05:36.000Z ::: emailSendingServer=101.73.243.17 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
action: block
emailfrom: bounces+36719643-009a-mwangsuwana=calprivate.bank@em9386.365firs-gov.com
emailsendingserver: 167.89.71.22
emailsubject: Invoice processing error for  CalPrivate Bank; POC: Mag Wangsuwana.
filehash: <ebJI_aIQQjiVw4xIz9Sj7g@geopod-ismtpd-15>
filename: from: bounces+36719643-009a-mwangsuwana=calprivate.bank@em9386.365firs-gov.com subj: Invoice processing error for  CalPrivate Bank; POC: Mag Wangsuwana.
messagetype: email_protection_event
productids: [32]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 2
severitylabel: critical
sourceinfo: unknown
starttimeutc: 2023-08-22T10:05:36.000Z
tags: ['proofpoint_protect', 'email_protection_event']
vendorcode: blocked_message
streamName: proofpoint_protect
serverIP: 101.73.243.17