WitFoo-Artifact ::: action=block ::: message={"spamScore":100,"phishScore":100,"threatsInfoMap":[{"threatID":"c88995f80e96afcc19288b797c28ae11bb88f4f62bc3f79b9fedf7822ff9395e","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/c88995f80e96afcc19288b797c28ae11bb88f4f62bc3f79b9fedf7822ff9395e","threatTime":"2023-08-29T06:58:37.000Z","threat":"r20.rs6.net/////////////////////////////tn.jsp?f=001X7MI9W9f6Xc-z8z0ArxBXYkTpH8QmtUlTTwex5-4BKgg6YkSrOeL2do0-iLe8wtkoliKuYwqkDBoQSqBlshGAJj0qZtjAOsUn09k4cUaC7Cj-uLPdxfKGbfidPmGQwrkP9LBfwwLane4QtfAi4HC8ovEtOzRZ9KUS3WCj5RUuzxRRhYnplcYfXJgMGXgb1jPHonvQWzen2uikghFaxRSzNHOGgJ0hqEe4vN9c4XDDvVv0oYgpstzB_Dndwxr6-t52ph0e7r4FyZ8NsbJW2ZSr9krjEWVb9q0XY756iKaq415CeBvzqN6qJTxOLRIQkrgL3BVmD9Qdmw4nZ1_g7uB28RIorMm9dz2OOiqKZlljNcDDUoYiGfbT9xdCyHdW_oP0W-BMy0GdU-ypgcQxGasVhtTj3r1LfrbpUKDcIdZgBKx0zI_rLFh55NGCvC5GqhiC8FxvXg-Myt38w-DbmGqMw==","campaignID":null,"threatType":"url"},{"threatID":"5b011fa04f14b710137f2b63fa4e8f8a0284a4ab660f4e662134a75a698888f6","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/5b011fa04f14b710137f2b63fa4e8f8a0284a4ab660f4e662134a75a698888f6","threatTime":"2023-08-29T12:22:13.000Z","threat":"https://email.mg.hyltonchimneys.co.uk/c/eJyMksvOgkYARp8Gd5hhZhiYhQuBX1TwgoqCG8P9KpcBAXn65m-bdtWkyUlO8uUsv3AFfIhwSBbRSiAUIUEQibhIV8ijfugLHo186OOIAgR94vlQEAVEAkoX2b89EBCRCZSAvBSWAqREgAATiCUsYwglxGHAvKwcve-iXKV933QcWnNww8ENg2DJOrKsov6v4X_SV8u8azi0iTmkASA40mFHHzQmTsDP8gzWbFIct7g1W9l693Z5u43RJPJYMZKEuMWVnSIThjXgMzOSx76oy8z4uGNbaEptXVul7FJ9vc9B--zz9amzK0ALHNieKqk5_zHP4RQbuh9n4fmtWyMrztRU4nE0vSrCVh-vM7xV5Xr46U_z5UkN-4oeai5e7M88XS6pWzVl4MbOPjnoTuIL-XlbV4P1mKMKfrIiSTfedLnOx-1JT_YgbX8iPBxpgB1NG-4DqN2k6fpZeWlVOE6M8L0ImxREEsOb71M-dv7-AZ9XRguW_zzuPm2B40oiyQyvxYKoRsowt0fS7m_TybzsrIIlJlLub41a4XvE1VN4JdJHgfJlV7PDm4YzPJ2y1niWZX4MNM2u3UyP_RudQvW7DR-v-gwevHL4Aj20-W-TBNake9097W85YoIZM7-xDS3Yhc9EMSYw717M3KSieNTVQRX1Ns1UeTMNTsIfvj2SR17z33p7GDmk_QJJ8LfSP436sWZV6r05KGLQeVWYRUndsGzw-sj3quL3Tgu2-if7z-iPUMBRELLAA___XnfPE","campaignID":null,"threatType":"url"},{"threatID":"982bce9b9daa2617888f472b85a131d8e79dc87c2bbd367bede203f9c32673eb","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/982bce9b9daa2617888f472b85a131d8e79dc87c2bbd367bede203f9c32673eb","threatTime":"2023-08-29T13:44:40.000Z","threat":"email.mg.hyltonchimneys.co.uk/c/","campaignID":null,"threatType":"url"},{"threatID":"ad24c0b1b8e5c2a53baf1dc708215adaaba41bb41ff2bca31993b7d02069dc3e","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/ad24c0b1b8e5c2a53baf1dc708215adaaba41bb41ff2bca31993b7d02069dc3e","threatTime":"2023-08-29T12:04:34.000Z","threat":"r20.rs6.net///////////////tn.jsp?f=001X7MI9W9f6Xc-z8z0ArxBXYkTpH8QmtUlTTwex5-4BKgg6YkSrOeL2do0-iLe8wtkoliKuYwqkDBoQSqBlshGAJj0qZtjAOsUn09k4cUaC7Cj-uLPdxfKGbfidPmGQwrkP9LBfwwLane4QtfAi4HC8ovEtOzRZ9KUS3WCj5RUuzxRRhYnplcYfXJgMGXgb1jPHonvQWzen2uikghFaxRSzNHOGgJ0hqEe4vN9c4XDDvVv0oYgpstzB_Dndwxr6-t52ph0e7r4FyZ8NsbJW2ZSr9krjEWVb9q0XY756iKaq415CeBvzqN6qJTxOLRIQkrgL3BVmD9Qdmw4nZ1_g7uB28RIorMm9dz2OOiqKZlljNcDDUoYiGfbT9xdCyHdW_oP0W-BMy0GdU-ypgcQxGasVhtTj3r1LfrbpUKDcIdZgBKx0zI_rLFh55NGCvC5GqhiC8FxvXg-Myt38w-DbmGqMw==","campaignID":null,"threatType":"url"}],"messageTime":"2023-08-29T12:19:38.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"New Message for twornham@sandiegoprivatebank.net","quarantineFolder":"Phish","quarantineRule":"inbound_phish","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":32432,"headerFrom":"\"Internal Alert\" <internals@mg.hyltonchimneys.co.uk>","headerReplyTo":null,"fromAddress":["internals@mg.hyltonchimneys.co.uk"],"ccAddresses":[],"replyToAddress":[],"toAddresses":["twornham@sandiegoprivatebank.net"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"8965b2697ad54ec7d6a425192e7e3c700ab4d26b88d9b50ef2195c8f42e99ad2","md5":"317ba30af298d11d5d8befd1f0cd7cf5","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"}],"completelyRewritten":false,"id":"ec4bc903-ca21-575b-f61e-377e470979cb","QID":"3sqfsc14bn-1","GUID":"QnUx8YWUWMGFRC9JCXlPgp11zTdyFVje","sender":"bounce+08c39e.0b234d6-twornham=sandiegoprivatebank.net@mg.hyltonchimneys.co.uk","recipient":["twornham@sandiegoprivatebank.net"],"senderIP":"175.78.170.226","messageID":"<1693311560136862708.1.1296120462474842273@railway>"} ::: fileHash=<1693311560136862708.1.1296120462474842273@railway> ::: fileName=from: bounce+08c39e.0b234d6-twornham=sandiegoprivatebank.net@mg.hyltonchimneys.co.uk subj: New Message for twornham@sandiegoprivatebank.net ::: serverIP=175.78.170.226 ::: emailFrom=bounce+08c39e.0b234d6-twornham=sandiegoprivatebank.net@mg.hyltonchimneys.co.uk ::: created_at=2023-08-29T12:19:38.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=New Message for twornham@sandiegoprivatebank.net ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-08-29T12:19:38.000Z ::: emailSendingServer=175.78.170.226 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "bounce+08c39e.0b234d6-twornham=sandiegoprivatebank.net@mg.hyltonchimneys.co.uk",
    "emailsendingserver": "143.55.232.4",
    "emailsubject": "New Message for twornham@sandiegoprivatebank.net",
    "filehash": "<1693311560136862708.1.1296120462474842273@railway>",
    "filename": "from: bounce+08c39e.0b234d6-twornham=sandiegoprivatebank.net@mg.hyltonchimneys.co.uk subj: New Message for twornham@sandiegoprivatebank.net",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":100,\"phishScore\":100,\"threatsInfoMap\":[{\"threatID\":\"c88995f80e96afcc19288b797c28ae11bb88f4f62bc3f79b9fedf7822ff9395e\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/c88995f80e96afcc19288b797c28ae11bb88f4f62bc3f79b9fedf7822ff9395e\",\"threatTime\":\"2023-08-29T06:58:37.000Z\",\"threat\":\"r20.rs6.net/////////////////////////////tn.jsp?f=001X7MI9W9f6Xc-z8z0ArxBXYkTpH8QmtUlTTwex5-4BKgg6YkSrOeL2do0-iLe8wtkoliKuYwqkDBoQSqBlshGAJj0qZtjAOsUn09k4cUaC7Cj-uLPdxfKGbfidPmGQwrkP9LBfwwLane4QtfAi4HC8ovEtOzRZ9KUS3WCj5RUuzxRRhYnplcYfXJgMGXgb1jPHonvQWzen2uikghFaxRSzNHOGgJ0hqEe4vN9c4XDDvVv0oYgpstzB_Dndwxr6-t52ph0e7r4FyZ8NsbJW2ZSr9krjEWVb9q0XY756iKaq415CeBvzqN6qJTxOLRIQkrgL3BVmD9Qdmw4nZ1_g7uB28RIorMm9dz2OOiqKZlljNcDDUoYiGfbT9xdCyHdW_oP0W-BMy0GdU-ypgcQxGasVhtTj3r1LfrbpUKDcIdZgBKx0zI_rLFh55NGCvC5GqhiC8FxvXg-Myt38w-DbmGqMw==\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"5b011fa04f14b710137f2b63fa4e8f8a0284a4ab660f4e662134a75a698888f6\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/5b011fa04f14b710137f2b63fa4e8f8a0284a4ab660f4e662134a75a698888f6\",\"threatTime\":\"2023-08-29T12:22:13.000Z\",\"threat\":\"https://email.mg.hyltonchimneys.co.uk/c/eJyMksvOgkYARp8Gd5hhZhiYhQuBX1TwgoqCG8P9KpcBAXn65m-bdtWkyUlO8uUsv3AFfIhwSBbRSiAUIUEQibhIV8ijfugLHo186OOIAgR94vlQEAVEAkoX2b89EBCRCZSAvBSWAqREgAATiCUsYwglxGHAvKwcve-iXKV933QcWnNww8ENg2DJOrKsov6v4X_SV8u8azi0iTmkASA40mFHHzQmTsDP8gzWbFIct7g1W9l693Z5u43RJPJYMZKEuMWVnSIThjXgMzOSx76oy8z4uGNbaEptXVul7FJ9vc9B--zz9amzK0ALHNieKqk5_zHP4RQbuh9n4fmtWyMrztRU4nE0vSrCVh-vM7xV5Xr46U_z5UkN-4oeai5e7M88XS6pWzVl4MbOPjnoTuIL-XlbV4P1mKMKfrIiSTfedLnOx-1JT_YgbX8iPBxpgB1NG-4DqN2k6fpZeWlVOE6M8L0ImxREEsOb71M-dv7-AZ9XRguW_zzuPm2B40oiyQyvxYKoRsowt0fS7m_TybzsrIIlJlLub41a4XvE1VN4JdJHgfJlV7PDm4YzPJ2y1niWZX4MNM2u3UyP_RudQvW7DR-v-gwevHL4Aj20-W-TBNake9097W85YoIZM7-xDS3Yhc9EMSYw717M3KSieNTVQRX1Ns1UeTMNTsIfvj2SR17z33p7GDmk_QJJ8LfSP436sWZV6r05KGLQeVWYRUndsGzw-sj3quL3Tgu2-if7z-iPUMBRELLAA___XnfPE\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"982bce9b9daa2617888f472b85a131d8e79dc87c2bbd367bede203f9c32673eb\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/982bce9b9daa2617888f472b85a131d8e79dc87c2bbd367bede203f9c32673eb\",\"threatTime\":\"2023-08-29T13:44:40.000Z\",\"threat\":\"email.mg.hyltonchimneys.co.uk/c/\",\"campaignID\":null,\"threatType\":\"url\"},{\"threatID\":\"ad24c0b1b8e5c2a53baf1dc708215adaaba41bb41ff2bca31993b7d02069dc3e\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/ad24c0b1b8e5c2a53baf1dc708215adaaba41bb41ff2bca31993b7d02069dc3e\",\"threatTime\":\"2023-08-29T12:04:34.000Z\",\"threat\":\"r20.rs6.net///////////////tn.jsp?f=001X7MI9W9f6Xc-z8z0ArxBXYkTpH8QmtUlTTwex5-4BKgg6YkSrOeL2do0-iLe8wtkoliKuYwqkDBoQSqBlshGAJj0qZtjAOsUn09k4cUaC7Cj-uLPdxfKGbfidPmGQwrkP9LBfwwLane4QtfAi4HC8ovEtOzRZ9KUS3WCj5RUuzxRRhYnplcYfXJgMGXgb1jPHonvQWzen2uikghFaxRSzNHOGgJ0hqEe4vN9c4XDDvVv0oYgpstzB_Dndwxr6-t52ph0e7r4FyZ8NsbJW2ZSr9krjEWVb9q0XY756iKaq415CeBvzqN6qJTxOLRIQkrgL3BVmD9Qdmw4nZ1_g7uB28RIorMm9dz2OOiqKZlljNcDDUoYiGfbT9xdCyHdW_oP0W-BMy0GdU-ypgcQxGasVhtTj3r1LfrbpUKDcIdZgBKx0zI_rLFh55NGCvC5GqhiC8FxvXg-Myt38w-DbmGqMw==\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-08-29T12:19:38.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"umbrella_hosted\",\"subject\":\"New Message for twornham@sandiegoprivatebank.net\",\"quarantineFolder\":\"Phish\",\"quarantineRule\":\"inbound_phish\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"dkimv\",\"spf\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":32432,\"headerFrom\":\"\\\"Internal Alert\\\" <internals@mg.hyltonchimneys.co.uk>\",\"headerReplyTo\":null,\"fromAddress\":[\"internals@mg.hyltonchimneys.co.uk\"],\"ccAddresses\":[],\"replyToAddress\":[],\"toAddresses\":[\"twornham@sandiegoprivatebank.net\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"8965b2697ad54ec7d6a425192e7e3c700ab4d26b88d9b50ef2195c8f42e99ad2\",\"md5\":\"317ba30af298d11d5d8befd1f0cd7cf5\",\"filename\":\"text.html\",\"sandboxStatus\":null,\"oContentType\":\"text/html\",\"contentType\":\"text/html\"}],\"completelyRewritten\":false,\"id\":\"ec4bc903-ca21-575b-f61e-377e470979cb\",\"QID\":\"3sqfsc14bn-1\",\"GUID\":\"QnUx8YWUWMGFRC9JCXlPgp11zTdyFVje\",\"sender\":\"bounce+08c39e.0b234d6-twornham=sandiegoprivatebank.net@mg.hyltonchimneys.co.uk\",\"recipient\":[\"twornham@sandiegoprivatebank.net\"],\"senderIP\":\"175.78.170.226\",\"messageID\":\"<1693311560136862708.1.1296120462474842273@railway>\"} ::: fileHash=<1693311560136862708.1.1296120462474842273@railway> ::: fileName=from: bounce+08c39e.0b234d6-twornham=sandiegoprivatebank.net@mg.hyltonchimneys.co.uk subj: New Message for twornham@sandiegoprivatebank.net ::: serverIP=175.78.170.226 ::: emailFrom=bounce+08c39e.0b234d6-twornham=sandiegoprivatebank.net@mg.hyltonchimneys.co.uk ::: created_at=2023-08-29T12:19:38.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=New Message for twornham@sandiegoprivatebank.net ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-08-29T12:19:38.000Z ::: emailSendingServer=175.78.170.226 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-08-29T12:19:38.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "175.78.170.226"
}