Tutanota 메일 사칭 피싱 메일-ipfs(.)dweb(.)link(2023.12.7)

오늘은 Tutanota 메일 사칭 피싱 메일-ipfs(.)dweb(.)link(2023.12.7)에 대해 글을 적어보겠습니다. 일단 해당 피싱 메일은 기본적으로 제목이 Pending Mail Error in ???????? on 12/7/2023 10:13:01 a.m.
이런 식으로 돼 있고 즉 메일 보류 에러가 나서 당신이 사이트 접속해서 사이트를 확인해야 한다는 식으로 돼 있습니다.

피싱 주소

https://bafybeifb3lfgimk73hlngz5ckmc4qzi33hpjybocutsrz63zavldyeduzu(.)ipfs(.)dweb(.)link
/?#?????@tutanota(.)com

Tutanota 메일 사칭 피싱 메일 내용

피싱 메일 내용

Your incoming messages have been placed on hold.
This pending messages will be deleted automatically after 48hours
We need to verify your ?????@tutanota(.)com address on our platform
Click the button "Verify me" below to deliver messages to your inbox.
✓ Verify me 
(07 December 2023)  from now (07 December 2023)
Recipient: Subject: 
Deliver  (???????@tutanota(.)com) RV: QUOTATION (05 December 2023) 
Deliver  (?????@tutanota(.)com ) ENC: Fwd: PAYMENT (05 December 2023) 
Deliver  (??????@tutanota(.)com ) R: PROFORMA INVOICE (06 December 2023) 
Deliver  (?????????@tutanota(.)com ) RE: BACK ORDER (06 December 2023) 
Note : This message was sent by  cPanel notification only. Please do not reply
Regards
tutanota(.)com  webmail  Team

한국어로 번역하면 다음과 같이 될 것입니다.

귀하의 수신 메시지가 보류되었습니다.
이 보류 중인 메시지는 48시간 후에 자동으로 삭제됩니다.
우리 플랫폼에서 귀하의 ????@tutanota(.)com 주소를 확인해야 합니다.
메일을 받은 편지함으로 전달하려면 아래의 '본인 확인' 버튼을 클릭하세요.
✓ 본인 인증
(2023년 12월 7일) 지금부터 (2023년 12월 7일)
수신자: 제목:
전달(????????@tutanota(.)com) RV: 견적(2023년 12월 5일)
배송(????@tutanota(.)com ) ENC: 전달: PAYMENT(2023년 12월 5일)
배송(??????@tutanota(.)com ) R: 견적 송장(2023년 12월 6일)
배송(????????@tutanota(.)com ) RE: BACK ORDER(2023년 12월 6일)
참고: 이 메시지는 cPanel 알림을 통해서만 전송되었습니다. 답장하지 마세요.
문안 인사
tutanota(.)com 웹메일 팀
한마디로 사람을 낚기 위한 장치입니다.

피싱 사이트 접속

이메일 헤더 내용

Authentication-Results: w10.tutanota(.)de (dis=neutral; info=dmarc default policy);
dmarc=pass(dis=neutral p=quarantine; aspf=r; adkim=r; pSrc=config)
header.from=indianaesta.sbs;dkim=pass header.d=indianaesta.sbs header.s=default
header.b=qS1O4rPt
Received: from w4.tutanota(.)de ([192.168.1(.)165])
by tutadb.w10(.)tutanota(.)de
with SMTP (SubEthaSMTP 3.1.7) id LPUZA6MC
for ?????@tutanota(.)com;Thu, 07 Dec 2023 10:11:00 +0100 (CET),
from mail0(.)indianaesta(.)sbs (mail0(.)indianaesta(.)sbs [198.46.211(.)240])
by w4.tutanota(.)de (Postfix) with ESMTPS id A1860106032B
for <????@tutanota(.)com>; Thu, 7 Dec 2023 09:10:59 +0000 (UTC)
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=198.46(.)211(.)240;
helo=mail0(.)indianaesta(.)sbs; envelope-from=contatti8@indianaesta(.)sbs; receiver=<UNKNOWN> 
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=indianaesta.sbs; 
h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type: Content-Transfer-Encoding;
i=contatti8@indianaesta(.)sbs; bh=nz2tQZ/amkMFKDe6qN(4)R45Zc4fIM8z5QT4D0Lyad7hs=;
b=qS1O4rPt6NU8Rimk(n)cLWUio056eb0YiVbWc1XVQTTVfH3UiZE6FFU98JbT7YoZBVJhimFm0ymeS0
PruINaf9S1K+OIodXr7fKu(Z)UNt13YHrug4lWLfzDxBWmOEISOhY7FJ7ohYMA9U4FfP9NHenR9d3i
xrcR+3xXepEPPx(p)WuTw=
From: "tutanota(.)com " <contatti8@indianaesta(.)sbs>
To:?????@tutanota(.)com
Subject:Pending Mail Error in ??????@tutanota(.)com on 12/7/2023 10:13:01 a.m.
Date: 07 Dec 2023 10:13:01 +0100
Message-ID: <20231207101301.F9FD30B2049B132B@indianaesta(.)sbs>
MIME-Version: 1.0 charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Type: multipart/related; boundary="------------79Bu5A16qPEYcV(I)ZL@tutanota"

헤더 해석

1.Authentication-Results:
w10(.)tutanota(.)de:해당 부분에서는 DMARC (Domain-based Message Authentication, Reporting, and Conformance)의 결과를 나타냄
DMARC 결과는 neutral이며 기본 정책은 quarantine 입니다.
DKIM 결과는 pass이며, SPF (Sender Policy Framework) 결과는 Pass
이메일 헤더의 송신자는 indianaesta(.)sbs 도메인
2. Received:
해당 부분에서는 이메일이 받은 서버의 정보가 포함되어 있음
메일이 w4(.)tutanota(.)de 서버를 거쳐서 전달되었으며 발신 서버의 IP 주소는 198.46.211(.)240
시간은 Thu, 07 Dec 2023 09:10:59 +0000 (UTC)
3. Received-SPF:
SPF의 결과로 Pass가 표시되어 있음
이메일의 발신자는 198.46.211(.)240 IP 주소에서 나왔으며 mail0(.)indianaesta(.)sbs 서버
4.DKIM-Signature:
DKIM (DomainKeys Identified Mail) 서명 정보가 포함되어 있음
DKIM 결과는 pass이며 서명에 사용된 키는 indianaesta(.)sbs 도메인의 default 키
5. From:
이메일의 송신자 주소는 tutanota(.)com 이라고 표시되어 있지만, 실제 송신자는 contatti8@indianaesta(.)sbs
6.Content-Transfer-Encoding:
콘텐츠의 전송 방식은 quoted-printable로 설정
한마디로 사기
여기서 사용자가 접속을 시도하며 앞서 표시한 주소로 이동하게 되고 여기서는 기본적으로 다음 사이트로 개인정보가 전송됩니다.

피싱 사이트 개인정보 입력시 로그인 에러 발생

https://edeaskates(.)co/clik/fire(.)php

HTTP Debugger Pro 본 피싱 메일 개인정보 전송

그리고 Raw 값은 다음과 같습니다.
POST /(c)lik/fire(.)php HTTP/1.1
Host: edeaskates(.)co
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: ko-KR,ko;q=0.8,en-US;q=0.5,en;q=0.3
Prefer: safe
Content-Type: application/x-www(-)form(-)urlencoded; charset=UTF-8
Origin: hxxps://bafybeifb3lfgimk73hlngz5ckmc4qzi33hpjybocutsrz63zavldyeduzu(.)ipfs(.)dweb(.)link
DNT: 1
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Accept-Encoding: gzip, deflate
Content-Length: 48
user=?????????&pass=test123%40!
입니다.
2023-12-09 15:22:52 UTC 기준 바이러스토탈 에서도 언제나 단골로 나오는 사이트이기 때문에 다음과 같이 차단을 하고 있습니다.
alphaMountain(.)ai:Phishing
Avira:Phishing
CRDF:Malicious
CyRadar:Malicious
Emsisoft:Phishing
Fortinet:Phishing
Netcraft:Malicious
Seclookup:Malicious
Trustwave:Phishing
Webroot:Malicious
Abusix:Spam
Forcepoint ThreatSeeker:Suspicious
항상 기본적인 보안 프로그램과 기본적인 보안수칙을 지키는 것이 안전하게 인터넷을 사용하는 방법입니다.