WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"6a0f50443e0088ea7330880fea7e0d95c52c3e0b8932a6f6c45f01f9c4cfeb3e","threatStatus":"active","classification":"malware","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/6a0f50443e0088ea7330880fea7e0d95c52c3e0b8932a6f6c45f01f9c4cfeb3e","threatTime":"2023-11-01T14:33:07.000Z","threat":"http://www.verticalresponse.com/landing/ef/?mm/13009f2b4f&utm_campaign=footer&utm_medium=referral&utm_source=footer","campaignID":"87cca984-0077-46fc-9a25-2f9a579361a9","threatType":"url"},{"threatID":"103fb82f67858c81e62186778071f71fe1edbe1924b003127fb1b9411edf5160","threatStatus":"active","classification":"malware","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/103fb82f67858c81e62186778071f71fe1edbe1924b003127fb1b9411edf5160","threatTime":"2023-10-30T16:34:44.000Z","threat":"https://verticalresponse.com/about/policy-and-terms","campaignID":null,"threatType":"url"},{"threatID":"c4044910a040660f48caa5b650ba7aafa0786ea01f33ad31b8d0508b0dbaef0b","threatStatus":"active","classification":"malware","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/c4044910a040660f48caa5b650ba7aafa0786ea01f33ad31b8d0508b0dbaef0b","threatTime":"2023-11-01T09:39:23.000Z","threat":"https://verticalresponse.com/about","campaignID":"87cca984-0077-46fc-9a25-2f9a579361a9","threatType":"url"},{"threatID":"5986731d9d59f3dc0629eae7c019b8f150c914f826feb34b8bff5deumbrella4d9891","threatStatus":"active","classification":"malware","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/5986731d9d59f3dc0629eae7c019b8f150c914f826feb34b8bff5deumbrella4d9891","threatTime":"2023-10-31T00:35:06.000Z","threat":"https://verticalresponse.com/about/policy-and-terms/","campaignID":null,"threatType":"url"}],"messageTime":"2023-10-25T15:44:59.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"Promo Items - $25 Off Your Next Order, Order Now","quarantineFolder":"Bulk","quarantineRule":"inbound_bulk","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":39668,"headerFrom":"\"Promo Direct\" <Promo_Direct@mail.vresp.com>","headerReplyTo":"\"Promo Direct\" <reply-13009f2b4f-e25654848b-9a9b@u.cts.vresp.com>","fromAddress":["promo_direct@mail.vresp.com"],"ccAddresses":[],"replyToAddress":["394fdffbcf529731f6709bd54a7dab7c@u.cts.vresp.com>"],"toAddresses":["lgonzalez@umbrella.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"8363141d179f0a8a1ffacb8492598101e22a99d1375ae64a4db709eef023d60f","md5":"1a13736242de9a09d7ea3656490f5b7d","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"},{"disposition":"inline","sha256":"c2bdf8e016de7cc07fb65547880e94d77ba4792ffa8be3d89da93117f4895b25","md5":"17e49487c1684da69858367addaf3b6a","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"}],"completelyRewritten":false,"id":"cc58eb48-90a8-62c3-b638-5ca18df8384b","QID":"3tvagqhnkh-1","GUID":"UcHu8RQ61S_a7Y4Wh7yaIh3sXJc0cS3K","sender":"bounces-13009f2b4f-e25654848b@b.cts.vresp.com","recipient":["lgonzalez@umbrella.bank"],"senderIP":"122.161.152.196","messageID":"<13009f2b4f-lgonzalez=umbrella.bank@mail.vresp.com>"} ::: fileHash=<13009f2b4f-lgonzalez=umbrella.bank@mail.vresp.com> ::: fileName=from: bounces-13009f2b4f-e25654848b@b.cts.vresp.com subj: Promo Items - $25 Off Your Next Order, Order Now ::: serverIP=122.161.152.196 ::: emailFrom=bounces-13009f2b4f-e25654848b@b.cts.vresp.com ::: created_at=2023-10-25T15:44:59.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Promo Items - $25 Off Your Next Order, Order Now ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-25T15:44:59.000Z ::: emailSendingServer=122.161.152.196 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "bounces-13009f2b4f-e25654848b@b.cts.vresp.com",
    "emailsendingserver": "74.116.88.134",
    "emailsubject": "Promo Items - $25 Off Your Next Order, Order Now",
    "filehash": "<13009f2b4f-lgonzalez=calprivate.bank@mail.vresp.com>",
    "filename": "from: bounces-13009f2b4f-e25654848b@b.cts.vresp.com subj: Promo Items - $25 Off Your Next Order, Order Now",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":0,\"threatsInfoMap\":[{\"threatID\":\"6a0f50443e0088ea7330880fea7e0d95c52c3e0b8932a6f6c45f01f9c4cfeb3e\",\"threatStatus\":\"active\",\"classification\":\"malware\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/6a0f50443e0088ea7330880fea7e0d95c52c3e0b8932a6f6c45f01f9c4cfeb3e\",\"threatTime\":\"2023-11-01T14:33:07.000Z\",\"threat\":\"http://www.verticalresponse.com/landing/ef/?mm/13009f2b4f&utm_campaign=footer&utm_medium=referral&utm_source=footer\",\"campaignID\":\"87cca984-0077-46fc-9a25-2f9a579361a9\",\"threatType\":\"url\"},{\"threatID\":\"103fb82f67858c81e62186778071f71fe1edbe1924b003127fb1b9411edf5160\",\"threatStatus\":\"active\",\"classification\":\"malware\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/103fb82f67858c81e62186778071f71fe1edbe1924b003127fb1b9411edf5160\",\"threatTime\":\"2023-10-30T16:34:44.000Z\",\"threat\":\"https://verticalresponse.com/about/policy-and-terms\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"c4044910a040660f48caa5b650ba7aafa0786ea01f33ad31b8d0508b0dbaef0b\",\"threatStatus\":\"active\",\"classification\":\"malware\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/c4044910a040660f48caa5b650ba7aafa0786ea01f33ad31b8d0508b0dbaef0b\",\"threatTime\":\"2023-11-01T09:39:23.000Z\",\"threat\":\"https://verticalresponse.com/about\",\"campaignID\":\"87cca984-0077-46fc-9a25-2f9a579361a9\",\"threatType\":\"url\"},{\"threatID\":\"5986731d9d59f3dc0629eae7c019b8f150c914f826feb34b8bff5deumbrella4d9891\",\"threatStatus\":\"active\",\"classification\":\"malware\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/5986731d9d59f3dc0629eae7c019b8f150c914f826feb34b8bff5deumbrella4d9891\",\"threatTime\":\"2023-10-31T00:35:06.000Z\",\"threat\":\"https://verticalresponse.com/about/policy-and-terms/\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-10-25T15:44:59.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"umbrella_hosted\",\"subject\":\"Promo Items - $25 Off Your Next Order, Order Now\",\"quarantineFolder\":\"Bulk\",\"quarantineRule\":\"inbound_bulk\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"dkimv\",\"spf\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":39668,\"headerFrom\":\"\\\"Promo Direct\\\" <Promo_Direct@mail.vresp.com>\",\"headerReplyTo\":\"\\\"Promo Direct\\\" <reply-13009f2b4f-e25654848b-9a9b@u.cts.vresp.com>\",\"fromAddress\":[\"promo_direct@mail.vresp.com\"],\"ccAddresses\":[],\"replyToAddress\":[\"394fdffbcf529731f6709bd54a7dab7c@u.cts.vresp.com>\"],\"toAddresses\":[\"lgonzalez@umbrella.bank\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"8363141d179f0a8a1ffacb8492598101e22a99d1375ae64a4db709eef023d60f\",\"md5\":\"1a13736242de9a09d7ea3656490f5b7d\",\"filename\":\"text.html\",\"sandboxStatus\":null,\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"inline\",\"sha256\":\"c2bdf8e016de7cc07fb65547880e94d77ba4792ffa8be3d89da93117f4895b25\",\"md5\":\"17e49487c1684da69858367addaf3b6a\",\"filename\":\"text.txt\",\"sandboxStatus\":null,\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"}],\"completelyRewritten\":false,\"id\":\"cc58eb48-90a8-62c3-b638-5ca18df8384b\",\"QID\":\"3tvagqhnkh-1\",\"GUID\":\"UcHu8RQ61S_a7Y4Wh7yaIh3sXJc0cS3K\",\"sender\":\"bounces-13009f2b4f-e25654848b@b.cts.vresp.com\",\"recipient\":[\"lgonzalez@umbrella.bank\"],\"senderIP\":\"122.161.152.196\",\"messageID\":\"<13009f2b4f-lgonzalez=umbrella.bank@mail.vresp.com>\"} ::: fileHash=<13009f2b4f-lgonzalez=umbrella.bank@mail.vresp.com> ::: fileName=from: bounces-13009f2b4f-e25654848b@b.cts.vresp.com subj: Promo Items - $25 Off Your Next Order, Order Now ::: serverIP=122.161.152.196 ::: emailFrom=bounces-13009f2b4f-e25654848b@b.cts.vresp.com ::: created_at=2023-10-25T15:44:59.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Promo Items - $25 Off Your Next Order, Order Now ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-10-25T15:44:59.000Z ::: emailSendingServer=122.161.152.196 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-10-25T15:44:59.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "122.161.152.196"
}