WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"b7733612fec4bcdabc260c04a77ff50f8bb99cd0a40656d7956d6214646acbaf","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/b7733612fec4bcdabc260c04a77ff50f8bb99cd0a40656d7956d6214646acbaf","threatTime":"2023-07-21T01:24:32.000Z","threat":"https://3txa3wwc28k.typeform.com/to/lMg5bZUC","campaignID":null,"threatType":"url"}],"messageTime":"2023-07-21T00:58:10.000Z","impostorScore":0,"malwareScore":0,"cluster":"umbrella_hosted","subject":"Notification: Updated Policy for Mid-year 2023-2024","quarantineFolder":"Quarantine","quarantineRule":"inbound_spam","policyRoutes":["default_inbound"],"modulesRun":["av","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":23350,"headerFrom":"\"HR Department\" <jdavis@anchor-house.org>","headerReplyTo":"jdavis@anchor-house.org","fromAddress":["jdavis@anchor-house.org"],"ccAddresses":[],"replyToAddress":["jdavis@anchor-house.org"],"toAddresses":["amolina@umbrella.bank"],"xmailer":"Zoho Campaigns","messageParts":[{"disposition":"inline","sha256":"846ea13f878ff2397dd96a9d1313daec221f446a0c8b31b95856e57ff7e8beda","md5":"399511e5148254e02b35fdd87f5dce4e","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"},{"disposition":"inline","sha256":"cb35fe4d8e44ec3afb461864f696478e295b34be0d29baee59d0837f47074f90","md5":"28e3e058c457a9fc12c546fa31a2bd52","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"}],"completelyRewritten":false,"id":"36f7fd9e-b3ef-4648-5458-3efe54809d20","QID":"3ruqaqt4t9-1","GUID":"HsKxDddUZd96RxUD_2TOYP1hUpnKk6pJ","sender":"bounce_818926149+a.1fc4394aef246564_v54@mail3.zgpl.zcsend.net","recipient":["amolina@umbrella.bank"],"senderIP":"246.120.193.225","messageID":"<zcb.3z03e6b6d342ef9f232f4e4dee3c47e66a5f39ddfe148ab85a3ab3ecd2772a8bba.1fc4394aef246564.1689901082055@mail3.zgpl.zcsend.net>"} ::: fileHash=<zcb.3z03e6b6d342ef9f232f4e4dee3c47e66a5f39ddfe148ab85a3ab3ecd2772a8bba.1fc4394aef246564.1689901082055@mail3.zgpl.zcsend.net> ::: fileName=from: bounce_818926149+a.1fc4394aef246564_v54@mail3.zgpl.zcsend.net subj: Notification: Updated Policy for Mid-year 2023-2024 ::: serverIP=246.120.193.225 ::: emailFrom=bounce_818926149+a.1fc4394aef246564_v54@mail3.zgpl.zcsend.net ::: created_at=2023-07-21T00:58:10.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Notification: Updated Policy for Mid-year 2023-2024 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-07-21T00:58:10.000Z ::: emailSendingServer=246.120.193.225 ::: pipelineEntrypoint=dispatch
{
    "action": "block",
    "emailfrom": "bounce_818926149+a.1fc4394aef246564_v54@mail3.zgpl.zcsend.net",
    "emailsendingserver": "135.84.83.136",
    "emailsubject": "Notification: Updated Policy for Mid-year 2023-2024",
    "filehash": "<zcb.3z03e6b6d342ef9f232f4e4dee3c47e66a5f39ddfe148ab85a3ab3ecd2772a8bba.1fc4394aef246564.1689901082055@mail3.zgpl.zcsend.net>",
    "filename": "from: bounce_818926149+a.1fc4394aef246564_v54@mail3.zgpl.zcsend.net subj: Notification: Updated Policy for Mid-year 2023-2024",
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":0,\"threatsInfoMap\":[{\"threatID\":\"b7733612fec4bcdabc260c04a77ff50f8bb99cd0a40656d7956d6214646acbaf\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/b7733612fec4bcdabc260c04a77ff50f8bb99cd0a40656d7956d6214646acbaf\",\"threatTime\":\"2023-07-21T01:24:32.000Z\",\"threat\":\"https://3txa3wwc28k.typeform.com/to/lMg5bZUC\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-07-21T00:58:10.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"umbrella_hosted\",\"subject\":\"Notification: Updated Policy for Mid-year 2023-2024\",\"quarantineFolder\":\"Quarantine\",\"quarantineRule\":\"inbound_spam\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"dkimv\",\"spf\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":23350,\"headerFrom\":\"\\\"HR Department\\\" <jdavis@anchor-house.org>\",\"headerReplyTo\":\"jdavis@anchor-house.org\",\"fromAddress\":[\"jdavis@anchor-house.org\"],\"ccAddresses\":[],\"replyToAddress\":[\"jdavis@anchor-house.org\"],\"toAddresses\":[\"amolina@umbrella.bank\"],\"xmailer\":\"Zoho Campaigns\",\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"846ea13f878ff2397dd96a9d1313daec221f446a0c8b31b95856e57ff7e8beda\",\"md5\":\"399511e5148254e02b35fdd87f5dce4e\",\"filename\":\"text.html\",\"sandboxStatus\":null,\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"inline\",\"sha256\":\"cb35fe4d8e44ec3afb461864f696478e295b34be0d29baee59d0837f47074f90\",\"md5\":\"28e3e058c457a9fc12c546fa31a2bd52\",\"filename\":\"text.txt\",\"sandboxStatus\":null,\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"}],\"completelyRewritten\":false,\"id\":\"36f7fd9e-b3ef-4648-5458-3efe54809d20\",\"QID\":\"3ruqaqt4t9-1\",\"GUID\":\"HsKxDddUZd96RxUD_2TOYP1hUpnKk6pJ\",\"sender\":\"bounce_818926149+a.1fc4394aef246564_v54@mail3.zgpl.zcsend.net\",\"recipient\":[\"amolina@umbrella.bank\"],\"senderIP\":\"246.120.193.225\",\"messageID\":\"<zcb.3z03e6b6d342ef9f232f4e4dee3c47e66a5f39ddfe148ab85a3ab3ecd2772a8bba.1fc4394aef246564.1689901082055@mail3.zgpl.zcsend.net>\"} ::: fileHash=<zcb.3z03e6b6d342ef9f232f4e4dee3c47e66a5f39ddfe148ab85a3ab3ecd2772a8bba.1fc4394aef246564.1689901082055@mail3.zgpl.zcsend.net> ::: fileName=from: bounce_818926149+a.1fc4394aef246564_v54@mail3.zgpl.zcsend.net subj: Notification: Updated Policy for Mid-year 2023-2024 ::: serverIP=246.120.193.225 ::: emailFrom=bounce_818926149+a.1fc4394aef246564_v54@mail3.zgpl.zcsend.net ::: created_at=2023-07-21T00:58:10.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=Notification: Updated Policy for Mid-year 2023-2024 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-07-21T00:58:10.000Z ::: emailSendingServer=246.120.193.225 ::: pipelineEntrypoint=dispatch",
    "messagetype": "email_protection_event",
    "productids": [
        32
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 2,
    "severitylabel": "critical",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-07-21T00:58:10.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "vendorcode": "blocked_message",
    "streamName": "proofpoint_protect",
    "serverIP": "246.120.193.225"
}