네이버 명예훼손 게시중단(임시조치)로 위장한 피싱 메일 분석(2025.2.5)

오늘은 네이버 명예훼손 게시중단(임시조치)로 위장한 피싱 메일 분석(2025.2.5)를 분석을 해 보겠습니다.
일단 해당 피싱 메일 내용은 다음과 같습니다.
작성하신 게시물이 
개시중단 처리되어 안내드립니다. 
안녕하세요, 권리보호센터 담당자입니다. 
고객님께서 작성하신 게시물이 게시중단(임시조치) 처리되어 안내드립니다. 
안내 내용 : 게시중단(임시조치) 처리 
대상 게시물 hxxps://blog(.)naver(.)com/??????/2131275326??? 
게시중단(임시조치) 요청자 관련 당사자 
게시중단(임시조치) 사유 명예훼손 (게시물로 인해 피해를 주장하는 당사자로부터 권리침해 신고 접수) 
게시중단(임시조치) 일자 2025년 02월 05일 
확인하러 가기  
참고 요청 사항 

네이버 권리보호센터 피싱 메일

게시중단(임시조치)는 정보통신망 이용촉진 및 정보보호 등에 관한 법률 제44조의 2(정보의 삭제요청 등)의 법령을 준수하기 위한 조치 입니다. 
▶ 관련법령 확인하기 
해당 법령에 따라 정보통신망(인터넷 등)을 통해서 일반에게 공개를 목적으로 제공된 정보로 인해 사생활 침해나 명예훼손 등 권리가 침해된 경우, 그 침해를 받은 자는 네이버와 같은 정보통신서비스 제공자에게 침해사실을 소명하여 그 정보의 삭제 또는 반박내용의 게재를 요청할 수 있으며, 정보통신서비스 제공자는 해당 정보의 삭제 등을 요청받으면 지체 없이 삭제·임시조치 등의 조치를 취하고 조치결과를 요청자 및 게시글 작성자에게 알려야 합니다. 
게시중단(임시조치)이 부당하다고 판단되시는 경우에는 게시물이 게시중단된 일자로부터 30일 이내 이의신청을 하실 수 있습니다. 
이의신청(소명하기)이 정상적으로 접수되면 30일간 임시 조치 후 게시물은 복원되며, 원 게시중단(임시조치) 요청자에게 게시물이 복원되었음이 통보됩니다. 만일 원 요청자가 여전히 본인의 권리가 침해 당하고 있다고 느낄 경우 법률에 따른 추가적인 행동 등이 취해질 수 있으므로 신중한 결정을 당부 드립니다. (게시중단일로부터 30일 내 이의신청이 없는 경우, 해당 게시물은 30일 이후에 자동 삭제되며 게시물 복원이 불가합니다.) 
감사합니다.
2025년 02월 05일 
네이버 권리보호센터 담당자 드림

피싱메일 이메일 헤더

이메일 헤더 내용

ARC-Seal: i=1; a=rsa-sha256; d=naver(.)com; s=arc-20180730; t=1738754763;
	cv=none; b=Oeb9VMbY7osebE1FcodVJVeBzI7U8J+NDTo1+cQhUGRuVAjvLsZqM706fEzn
	 QWBJ5zlvQs5H4Xa1jbOa1fUhJTf3ma6pSTzKx4dsSSRR/0ZlptCc1zs+ZPeIj2/hQk392F
	 R/LmDBQSsgYVONmIxF0rMmv1w9Hf+oguam7bPRLmBf4cazLU4IOnmW9soDR372mMls6fXb
	 HDZbRXFgtXFVfNnFpkKWUy3UDeHW80QcHHsU27PfwWygZblFfKSHk8bbzB/jvW5+u9dFgw
	 EGGL3WjolbzrF32tWlLQH+7jINSRhxWqfTLBmk87uBmDD7HQhqtB0Ij58LWtoY1+ComL7F
	 tQ==
ARC-Message-Signature: i=1; a=rsa-sha256; d=naver.com; s=arc-20180730;
	t=1738754763; c=relaxed/relaxed;
	bh=k9svX2j/yGGZN0+RSUExw9+V8kchzisoVXs/hInqPss=;
	h=dkim-signature:date:to:from:subject:message-id; b=YmyNxdSaQ4cjcndM6tx
	 D6lIODH5azQnZ7kc87xUPMrF8hq01VFHmBGh5yng6T5K1aOPCC3D4AvivfFAjgX7gRO4Ks
	 /rjUgv0MM1XQ1kongW84G0Fqa3BSEx5WUmSUXFkSczH1b9/cJxv9FYqJ3+6LQA4ib2CFrX
	 Vq7XtyI+W4IAh2VVLzNjVQkOcbfPKTsU1O0Hn53EF99mss2WIfpYyAN92Z34p7PJtvVbNJ
	 9KPWIti57NIN/RBsBHOpXdm/yjf4EEhq0P+XPdRnXwsCa/hbfDyQ4xDNpf5W1N8fUF9YEE
	 ct5eeSqDxw/8KjCFg9ZtG4GWH7u+G4++jW9RT6I+4/Q==
ARC-Authentication-Results: i=1; mx(.)naver(.)com; 
  spf=pass (mx(.)naver(.)com: domain of msquare@internet(.)ru designates 95(.)163(.)59(.)118 as permitted sender) smtp.mailfrom=msquare@internet(.)ru;
  dkim=pass header.i=@internet(.)ru;
  dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=internet(.)ru
Return-Path: <msquare@internet(.)ru>
Received-SPF: pass (mx(.)naver(.)com: domain of msquare@internet(.)ru designates 95(.)163(.)59(.)118 as permitted sender)
  client-ip=95(.)163(.)59(.0118; x-iptype=default;
Authentication-Results: mx(.)naver(.)com;
  spf=pass (mx(.)naver(.)com: domain of msquare@internet(.)ru designates 95(.)163(.)59(.)118 as permitted sender) smtp.mailfrom=msquare@internet.ru;
  dkim=pass header.i=@internet.ru;
  dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=internet.ru
X-Naver-ESV: wfRn+6J4p63CbHmqKBwdbXFYKxuZFogZjJ+Y
X-Session-IP: 95(.)163(.)59.118
Received: from send279.i(.)mail(.)ru (send279(.)i(.)mail.ru [95(.)163(.)59.118])
  by ???.nm.naver(.)com with ESMTP id +d12MSrmSa2ztO60qhmCrQ
  for <???@naver(.)com>
  (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384);
  Wed, 05 Feb 2025 11:26:02 -0000
	for ???@naver(.)com; Wed, 05 Feb 2025 14:25:59 +0300
Date: Wed, 5 Feb 2025 12:22:47 +0100
To: ????@naver(.)com
From: =?UTF-8?B?7Iug6rOg7ISc67mE7Iqk?= <msquare@internet(.)ru>
Subject: =?UTF-8?B?7J6R7ISx7ZWY7IugIOqyjOyLnOusvOydtCDqsozsi5zspJHri6gg7LKY66as?=
 =?UTF-8?B?65CY7Ja0IOyViOuCtOuTnOumveuLiOuLpC4=?=
Message-ID: <f44e601afc0435f417ba5d30b4f600f7@118.194.249.171>
X-Mailer: PHPMailer 5.2.14 (hxxps://github(.)com/PHPMailer/PHPMailer)
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="b1_f44e601afc0435f417ba5d30b4f600f7"
Authentication-Results: exim-smtp-6d97ff8cf4-254xs; auth=pass smtp(.)auth=msquare@internet(.)ru smtp.mailfrom=msquare@internet(.)ru
X-Mailru-Src: smtp

이메일 헤더 분석

1.기본 헤더 분석
발신자 (From):msquare@internet(.)ru  
수신자 (To):????@naver(.)com  
메일 서버:send279(.)i(.)mail(.)ru (95(.)163(.)59(.)118)  
메일 발송 도구:PHPMailer 5.2.14  
DKIM(DomainKeys Identified Mail) 인증: internet(.)ru 도메인 서명
SPF(Sender Policy Framework) 인증:95(.)163(.)59(.)118이 발신 허용 IP로 지정
DMARC(Domain-based Message Authentication) 정책:p=REJECT
ARC (Authenticated Received Chain):cv=none (연결된 인증 정보 없음)  
2. 발신 IP 주소 및 서버 정보
발신 IP:95(.)163(.)59(.)118  
3. 메일 제목 및 인코딩 분석
제목: 청구서 발송 안내 – 긴급 확인 필요
4.PHPMailer 사용 여부
이메일은 PHPMailer 5.2.14를 사용하여 발송됨
PHPMailer는 합법적인 메일 전송 라이브러리이지만 스팸/피싱 메일 발송에도 자주 악용됨
공식적인 기업 이메일이라면 자체적인 SMTP 서버나 Exchange 서버를 사용하지만 그게 아님
PHPMailer를 사용하는 점에서 자동화된 스팸 또는 피싱 이메일일 가능성 매우 큼
5. 결론 및 대응 방안
SPF, DKIM, DMARC를 모두 통과한 점에서 mail(.)ru 공식 서버에서 보낸 메일로 보이지만 네이버 본사는 한국에 있으므로 저거 100% 낚시

사용하는 피싱 주소

hxxp://niduser.www.dns.checkinfo.n-sign(.)o-r(.)kr/bloguser/?q=viewInputPasswdF
orMyInfo&menu=security&wreply=Y2xvdmVyZmFueUBuYXZlci5jb20=&m=https%3A%2F%2Fnid.
naver.com%2Fnidlogin(.)login%3Furl%3Dhttp%253A%252F%252Fmail
.naver(.)com%252F