WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"8fd3728893e3b870853ee316a47d61eeb8120ce0c0789639391e43832a6e08fa","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/8fd3728893e3b870853ee316a47d61eeb8120ce0c0789639391e43832a6e08fa","threatTime":"2023-02-09T12:17:19.000Z","threat":"https://cm.naukri.com/?redirect=https%3A%2F%2Fevuuy1.codesandbox.io?ga=YmZhdXN0aW5vQGNhbHByaXZhdGUuYmFuaw==","campaignID":null,"threatType":"url"}],"messageTime":"2023-02-09T12:16:26.000Z","impostorScore":0,"malwareScore":0,"cluster":"wayne_hosted","subject":"­S­e­c­u­r­­e M­e­s­s­a­g­e­: 2OL6OF1A/1782214979","quarantineFolder":"Quarantine","quarantineRule":"inbound_spam","policyRoutes":["default_inbound"],"modulesRun":["av","zerohour","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":12296,"headerFrom":"\"Calprivate\" <leticiaandrade@sedam.ro.gov.br>","headerReplyTo":"<olgal_mkt@jaimetorres.net>","fromAddress":["leticiaandrade@sedam.ro.gov.br"],"ccAddresses":[],"replyToAddress":["4dc55a33fd232724c1e2714b70b38ee0@jaimetorres.net>"],"toAddresses":["bfaustino@wayne.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"81c2ca8edcb5a57bc6e497c92ade977dec5b86a7e8b502cb006d4dca66d00603","md5":"6682aa92a4f412a6caa71343f3bf79be","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"},{"disposition":"attwayneed","sha256":"cc73434f1f59dcc971107968de4617b26f65e5ee1f5d9cd13ed7a3d6b265ff31","md5":"a21c383beb1805d65b1311a41cb8f90a","filename":"2333454msn.png","sandboxStatus":null,"oContentType":"image/png","contentType":"image/png"},{"disposition":"inline","sha256":"8f645fb4c28779ada8d3368fe378d97a319fb3861ee498d8620aa1d3095d9c65","md5":"c6d6840ff102727aba6f6b9684274586","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"}],"completelyRewritten":false,"id":"afe6ec3c-ef90-8eab-bf23-2709176eab52","QID":"3nhm41hheh-1","GUID":"ygTGToFoxPqfWG17n-EcYfUj-gTL2hYW","sender":"leticiaandrade@sedam.ro.gov.br","recipient":["bfaustino@wayne.bank"],"senderIP":"72.239.203.198","messageID":"<202309021508113BF6AF47DB$48FE390D30@sedam.ro.gov.br>"} ::: fileHash=<202309021508113BF6AF47DB$48FE390D30@sedam.ro.gov.br> ::: fileName=from: leticiaandrade@sedam.ro.gov.br subj: ­S­e­c­u­r­­e M­e­s­s­a­g­e­: 2OL6OF1A/1782214979 ::: serverIP=72.239.203.198 ::: emailFrom=leticiaandrade@sedam.ro.gov.br ::: created_at=2023-02-09T12:16:26.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=­S­e­c­u­r­­e M­e­s­s­a­g­e­: 2OL6OF1A/1782214979 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-02-09T12:16:26.000Z ::: emailSendingServer=72.239.203.198 ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Protect by ProofPoint. The following fields were extracted from the message:
emailsubject: ­S­e­c­u­r­­e M­e­s­s­a­g­e­: 2OL6OF1A/1782214979
senderhost: localhost
severitylabel: critical
starttimeutc: 2023-02-09T12:16:26.000Z
tags: ['proofpoint_protect', 'email_protection_event']
productids: [32, 0]
filename: from: leticiaandrade@sedam.ro.gov.br subj: ­S­e­c­u­r­­e M­e­s­s­a­g­e­: 2OL6OF1A/1782214979
severitycode: 2
sensitivity: normal
emailsendingserver: 201.2.96.71
messagetype: email_protection_event
emailfrom: leticiaandrade@sedam.ro.gov.br
sourceinfo: unknown
filehash: <202309021508113BF6AF47DB$48FE390D30@sedam.ro.gov.br>
vendorcode: blocked_message
action: block
streamName: proofpoint_protect
serverIP: 72.239.203.198