네이버 전자 문서 사칭 피싱 메일-새로 도착한 세무안내서를 확인하세요.(2025.1.27)

오늘은 네이버 전자 문서 사칭 피싱 메일-새로 도착한 세무안내서를 확인하세요.(2025.1.27)에 대해 알아보겠습니다.
해당 내용은 마치 국세청에서 이메일 보낸 것처럼 되어 있지만, 가짜 즉 피싱입니다
피싱 메일 내용
새로운 전자문서가 도착했어요. 인증기한이 지나면 문서를 확인할 수 없으니 꼭 기한 내에 확인하세요.
2단계 인증을 이용하시는 분들은 앱에 오는 알림을 탭 해주세요.
발송기관 국세청 세무조사위원회  
전자문서 종류 전자통지서  
인증기한 2025-02-10 00:10:02
기한 내 열람하지 않으면 발송기관정책에 따라 다른 수단(종이우편, SMS/LMS 등) 또는 다른 채널(타사앱)로 발송됩니다. 
기관에서 정식 발송된 문서는 너lㅇl버앱＞Ｎａ.앱＞ 전자문서에 표시됩니다. 
일단 내용을 잘 보면 네이버 전자문서로 일단 메일 내용을 보면 네이버 전자 문서인 것처럼 보이지만 어디인가 허술한 것을 확인할 수가 있습니다.

국세청 사칭 메일 내용

이메일 헤더

ARC-Authentication-Results: i=1; mx(.)naver(.)com;   spf=pass (mx(.)naver(.)com: domain of slcjoemy@box5378(.)bluehost(.)com designates 44(.)202(.)169(.)36 as permitted sender) smtp.mailfrom=slcjoemy@box5378(.)bluehost(.)com;  dkim=pass header.i=@slc(.)joe(.)mybluehost(.)me
Return-Path: slcjoemy@box5378(.)bluehost(.)com
Received-SPF: pass (mx(.)naver(.)com: domain of slcjoemy@box5378(.)bluehost(.)com designates 44(.)202(.)169(.)36 as permitted sender)  client-ip=44(.)202(.)169(.)36; x-iptype=default;,pass (mx(.)naver(.)com: domain of naverpayadmin_noreply@navercorp(.)com designates 35(.)89(.)44(.)39 as permitted sender)  client-ip=35(.)89(.)44(.)39; x-iptype=white;
Authentication-Results: mx(.)naver(.)com;  spf=pass (mx(.)naver(.)com: domain of slcjoemy@box5378(.)bluehost(.)com designates 44(.)202(.)169(.)36 as permitted sender) smtp.mailfrom=slcjoemy@box5378(.)bluehost(.)com;  dkim=pass header.i=@slc(.)joe.mybluehost(.)me,mx(.)naver(.)com; spf=pass (mx(.)naver(.)com: domain of naverpayadmin_noreply@navercorp(.)com designates 35(.)89(.)44(.)39 as permitted sender) smtp.mailfrom=naverpayadmin_noreply@navercorp(.)com;  dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=navercorp.com
X-Naver-ESV: wZRn+6J4p63qMBIYKHwdbXmwFxg9KAJYkXm=
X-Session-IP: 44(.)202(.)169.36
Received: from omta037(.)useast(.)a.cloudfilter(.)net 
.......

피싱 메일 이메일 헤더

이메일 헤더 분석

1. ARC(Authenticated Received Chain)
ARC-Seal,ARC-Message-Signature, ARC-Authentication-Results
ARC-Seal & ARC-Message-Signature는 이메일이 중간 서버를 거쳐도 원본 인증 정보를 유지할 수 있도록 하는 서명
cv=none: RC 체인의 검증(cv)이 없다는 것은 해당 서명이 신뢰할 수 없거나 검증이 실패
2. 발신자 및 SPF, DKIM, DMARC 인증 상태  
SPF(Sender Policy Framework)
spf=pass: slcjoemy@box5378(.)bluehost(.)com이(는) 44(.)202(.)169(.)36 서버를 통해 전송
spf=pass:naverpayadmin_noreply@navercorp(.)com 35(.)89(.)44(.)39을 통해 전송 보낸 사람의 이메일 주소가 조작됨
DKIM(DomainKeys Identified Mail)
dkim=pass header.i=@slc(.)joe(.)mybluehost(.)me:해당 이메일이 slc(.)joe(.)mybluehost(.)me 도메인에서 보낸 것으로 DKIM 서명
3.이메일 발송 경로 (Received 헤더 분석)
이메일이 여러 개의 서버를 거쳐 전송됨.
box5378(.)bluehost(.)com (162(.)241(.)216(.)50)에서 발송  
eig-obgw-6008a(.)ext(.)cloudfilter(.)net 거침  
omta037(.)useast(.)a(.)cloudfilter(.)net (44(.)202(.)169(.)36)에서 crcvmail201(.)nm(.)naver(.)com 전송됨  
최종적으로 ?????@naver(.)com 수신  
발신자는 slcjoemy@box5378(.)bluehost(.)com 이지 naverpayadmin_noreply@navercorp(.)com과 SPF 인증이 통과됨
Blue host(웹 호스팅 서비스)에서 이메일을 발송 가능성이 매우 큼
DKIM 서명이 slc(.)joe(.)mybluehost(.)me 에서 정상적으로 인증됨
X-PHP-Script 헤더:devateanddispute(.)com/wp-sendqq(.)php  
PHP 기반의 wp-sendqq(.)php 스크립트를 통해 이메일을 전송
발신 IP(44(.)202(.)169(.)36,162(.)241(.)216(.)50) 
NaverPay 와 전혀 관계없음
발신 IP 들을 threatbook 에서 조회를 해보면 경력이 화려한 것을 확인할 수가 있음
발신 주소 등을 확인해야 하면 최근 블로그에 적은 것처럼 의료기관 사칭한 것처럼 진짜 유튜브인 것처럼 URL 가지고 장난치는 일도 있으니 조심하시길 바랍니다.