DHL 사칭 피싱 메일-noreply@dhl(.)com(2023.11.9)

오늘은 DHL 사칭 피싱 메일인 noreply@dhl(.)com 에 대해 글을 적어 보겠습니다. DHL 익스프레스(DHL Express)는 독일의 배송사 이며 1969년에 설립된 세계적인 종합 우편/물류 서비스 회사로, 현재는 독일 도이체 포스트의 자회사이며 국제 배송 및 특송 사업 부문을 하고 있으며 한국에서는 해외 직구를 이용할 때도 자주 사용을 하기도 합니다. 일단 오늘 온 이메일 내용은 다음과 같습니다.

DHL 피싱 메일

DHL Shipping Document/Tracking No Confirmation 
Dear ????
The following  Shipment cannot be delivered  to
your destination due to error in receipients details. 
You're oblidged  to make neccesary amendment immediately. Details of shipment are below.
SCHEDULE & DETAILS; 
Expected Delivery Date: 9 Nov 2023
Type of Shipment: AIR WAY BILL
Amend Delivery Details & Review Docs
Download attached to View Document & Tracking No   
Always serving you better! 
DHL Delivery Team

매번 느끼는 일이지만 어째 날짜만 바뀌고 변한 것이 없는 것 같은 느낌이 든다는….
한국어로 대충 번역을 하면 다음과 같이 됩니다.

DHL 피싱 사이트 화면

DHL 배송 문서/추적 확인 불가
에게 ????
수취인 정보 오류로 말미암아 다음 배송물을 목적지까지 배송할 수 없습니다.
귀하는 즉시 필요한 수정을 해야 할 의무가 있습니다. 배송 세부사항은 다음과 같습니다.
일정 및 세부정보
예상 배송일: 2023년 11월 9일
배송 유형: 항공운송장
배송 세부정보 수정 및 문서 검토
문서 보기 및 추적 번호에 첨부된 다운로드
항상 더 나은 서비스를 제공합니다!
DHL 배송팀
한마디로 배송 추적 확인 불가,수취인 정보 오류 때문에 너의 배송물을 목적지까지 보낼 수가 없어 그러니 해당 사이트 접속을 해서 너의 아름답고 소중한 이메일 비밀번호를 입력해달라고 함

피싱 메일 헤더 내용

Authentication-Results: w10.tutanota(.)de (dis=reject; info=dmarc domain policy);
dmarc=fail (dis=reject p=reject; aspf=r; adkim=r; pSrc=dns) header.from=dhl(.)com
Received: from w1.tutanota(.)de ([192.168.1(.)162]
by tutadb(.)w10.tutanota(.)de
with SMTP (SubEthaSMTP 3.1.7) id LOR4QJJ4
for ????@tutanota(.)com;Thu, 09 Nov 2023 12:52:47 +0100 (CET),
from abcsuipply(.)com (unknown [185.236.228(.)250])
by w1.tutanota(.)de (Postfix) with ESMTP id 7DB36FBFAB7
for <??????@tutanota(.)com>; Thu,  9 Nov 2023 11:52:47 +0000 (UTC),from [94.156.68(.)157]
(abcsuipply(.)com [IPv6:::1])
by abcsuipply(.)com (Postfix) with ESMTP id E884374A5FF
for <??????@tutanota(.)com>; Thu,  9 Nov 2023 06:37:47 +0000 (UTC)
Received-SPF: Softfail (mailfrom) identity=mailfrom;client-ip=185.236.228(.)250;
helo=abcsuipply(.)com; envelope-from=noreply@dhl(.)com; receiver=<UNKNOWN> 
From: "DHL" <noreply@dhl(.)com>
To:?????@tutanota(.)com
Subject: New Incoming shipment delivery Notification.
Date: 9 Nov 2023 07:37:47 +0100
Message-ID: <20231109073747.757AD9BBF7E22D1F@dhl(.)com>
MIME-Version: 1.0	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Type: multipart/related; boundary="------------79Bu5A16qPEYcVIZL@tutanota"

이메일 헤더 내용 설명

1.Authentication-Results:
w10.tutanota(.)de:*해당 부분에서는 tutanota(.)de 도메인의 인증 결과를 나타낸 이메일이 DMARC 정책에 따라 거부되었으며, DMARC 실패로 표시
2.Received:
w1.tutanota(.)de:해당 부분은 이메일이 w1.tutanota(.)de 서버를 거쳐 전달되었음을 나타냄
SMTP를 통해 전달되었으며 해당 서버에서는 Postfix를 사용하고 있음
abcsuipply(.)com:메일의 출발지 도메인으로, 해당 도메인의 IP 주소는 185.236.228(.)250
94.156.68(.)157:abcsuipply(.)com에서 이메일이 최종 전송된 서버의 IP 주소
3.Received-SPF:
해당 부분에서는 SPF(Sender Policy Framework) 검사 결과가 표시
메일의 출발지 도메인인 dhl(.)com의 SPF 정책을 따르지 않았으며, Softfail로 표시
4.From:
발신자 정보
DHL로 표시되며 발신자 주소는 noreply@dhl(.)com
5.To: 수신자의 이메일 주소
6.Subject:이메일의 주제로 New Incoming shipment delivery Notification 으로 표시되어 있음
7.Date:이메일이 생성된 날짜 및 시간으로 2023년 11월 9일 07:37:47 (중앙 유럽 시간, CET)
8.Message-ID: 이메일을 식별하는 고유한 ID
9.MIME-Version:MIME(Multipurpose Internet Mail Extensions) 버전으로 1.0으로 표시되어 있음
10.Content-Transfer-Encoding: 이메일 본문의 인코딩 방식으로 quoted-printable로 표시
11.Content-Type: 이메일 본문의 형식으로 multipart/related로 표시되었으며, 여러 부분으로 이루어진 메일을 나타냄

DHL 피싱 사이트

hxxps://bafybeicbf5vcy43mclk25ih2ti4lmfxtxmmcci2km474k2qpe3spdu7i2e(.)ipfs(.)cf-ipfs(.)com
/megatrodhl(.)html#?????@tutanota(.)com

여기서 비밀번호를 입력하면 Login with your correct email password…. 이라는 메시지를 볼 수가 있으며 
해당 피싱 사이트 의 Raw 값은 다음과 같습니다.

POST /tosydhl/log%2(0)%281%29%20%281%29(.)php HTTP/1(.)1
Host: earlyenviromnental(.)com
User-Agent: Mozilla/5.0 (Linux; Android 13; SAMSUNG SM-S918N) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/22.0.3.1 Chrome/118.0.0.0 Mobile Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: ko-KR,ko;q=0.8,en-US;q=0.5,en;q=0.3
Prefer: safe
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: hxxps://bafybeicbf5vcy43mclk25ih2ti4lmfxtxmmcci2km474k2qpe3spdu7i2e(.)
ipfs(.)cf-ipfs(.)com
DNT: 1
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Accept-Encoding: gzip, deflate
Content-Length: 53
email=?????%40tutanota(.)com&password=TEST123%40!

DHL 피싱 사이트 개인정보 전송 Raw 값

최종적으로 개인정보 전송되는 주소

hxxps://earlyenviromnental(.)com/tosydhl/log%20%281%29%20%281%29(.)php

[브라우저 부가기능/파이어폭스 부가기능] - 악성 사이트(피싱사이트)등으로 부터 보호해주는 파이어폭스 부가기능-Emsisoft Browser Security

악성 사이트(피싱사이트)등으로 부터 보호해주는 파이어폭스 부가기능-Emsisoft Browser Security

일단 기본적으로 백신 프로그램, 브라우저 보안 기능은 활성화해서 사용을 하시는 것이 안전하게 사용을 할 수가 있습니다. 기본적으로 지난 시간에 소개해 드린 Emsisoft Browser Security 부가기능은 구글 크롬, 파이어폭스, 마이크로소프트 엣지 등에서 스토어 가서 설치할 수가 있으니 기본적으로 설치해서 사용하시는 것을 추천합니다.