투타노타(Tuta) 계정 메일 사칭 피싱 이메일-Mail Delivery error(2024.5.16)

오늘은 회사와 서버는 독일에 있으며 종단간 암호화 방식을 사용해서 암호화 이메일 보안 이메일 서비스를 제공하는 보안 업체인 투타노타(Tuta) 사칭 이메일 Mail Delivery error(2024.5.16)에 대해 글을 적어 보겠습니다. 해당 메일은 내용은 간단합니다.
너~계정 접속에 오류가 있니 등으로 접근하는 방식을 사용합니다.

Blocked Incoming Messages
The following messages have been held in your waiting list.
You have 11 new messages in your email quarantine. Date: 15/05/2024 08:22:00 -0700 (CDT) User: ????@tutanota(.)com
Click On Release , to Release these message(s) to your inbox folder: Deliver Messages
Quarantined email
Recipient: Subject: Date:
Release ????@tutanota.com ENC: Fwd: PAYMENT  13/05/2024
Release ????@tutanota(.)com RE: BACK ORDER 13/05/2024
Release ???@tutanota(.)com Re: PROFORMA   14/05/2024
Release ????@tutanota(.)com RV: QUOTATION  14/05/2024
Deliver all messages (11)
Note: This message was sent by the system for notification only. Please do not reply
If this message lands in your spam folder, please move it to your inbox folder for proper integration: Click Here
이번에는 결제 뭐~이런 식으로 온 것을 보니 언제나 패턴은 똑같은 것 같습니다.
이메일을 분석하기 위해서 헤더를 까 봐야 하므로 헤더를 보면 다음과 같습니다.

투타노타 피싱 메일

이메일 헤더 내용

Authentication-Results: w10.tutanota(.)de (dis=neutral; info=dmarc default policy);
dmarc=pass (dis=neutral p=quarantine; aspf=r; adkim=r; pSrc=config)
header.from=tankertelz.co;	dkim=pass header.d=tankertelz.co header.s=default
header.b=GDkHqiS4
Received: from mail(.)w11.tutanota(.)de ([192.168(.)1(.)211])
by tutadb(.)w10(.)tutanota(.)de
with SMTP (SubEthaSMTP 3.1.7) id LW8PLOBZ
for @tutanota(.)com;Thu, 16 May 2024 05:46:53 +0200 (CEST),
from mail5.tankertelz(.)co (mail5(.)tankertelz(.)co [107.174.234(.)145]
by mail.w11.tutanota(.)de (Postfix) with ESMTPS id 399D6D05645C	for <@tutanota(.)com>;
Thu, 16 May 2024 05:46:52 +0200 (CEST)
Received-SPF: Pass (mailfrom) identity=mailfrom;
client-ip=107.174.234(.)145; helo=mail5.tankertelz(.)co;
envelope-from=platini93@tankertelz(.)co; receiver=<UNKNOWN> 
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default;
d=tankertelz(.)co; h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:
Content-Transfer-Encoding; i=platini93@tankertelz(.)co; bh=6T/U0Cq8TxaZSxnDbxh
(c)Hhjy8zVhGgEKiAPDrieZtZE=; b=GDkHqiS4Y(j)wfHHfeYuHdMd914EN(B)6Tyth2Cy4pmDIdJ
bglvUlj5tgyojHu02PtqbcP4QKK/ZO9qX   v5iDNWnIJEFK3JBMTPvtwQadL4fKQ1C6FI(a)IJHhM
QJDeSNyJLjBN3lqcD1jDLTn+9dst7Ii5sxWN   tC0EBvgCEQrC+oevV1g=
From: "tutanota(.)com " <platini93@tankertelz(.)co>
To:@tutanota(.)com
Subject: Mail Delivery error in @tutanota(.)com on 5/16/2024 5:48:39 a.m.
Date: 16 May 2024 05:48:40 +0200
Message-ID: <20240516054839.34FB7B9BD87DF1DD@tankertelz(.)co>
MIME-Version: 1.0
charset="iso-8859-1"

이메일 헤더 분석

Received 헤더:
mail(.)w11.tutanota(.)de 서버가 tutadb.w10.tutanota(.)de 서버로부터 이메일을 받음
mail5.tankertelz.co 서버가 mail.w11.tutanota(.)de 서버로 이메일을 보냄
수신 시간: 2024년 5월 16일 05:46:52 (CEST)
Received-SPF:
SPF 검증 통과(Pass)
발송 IP: 107.174.234(.)145
발송 도메인:mail5.tankertelz(.)co
DKIM-Signature:
DKIM 서명 정보: RSA-SHA256, 서명 도메인(tankertelz(.)co), 선택기(default)
헤더 필드: From, To, Subject, Date, Message-ID 등
기타 헤더 정보:

피싱 메일 이메일 헤더

발신자:tutanota(.)com <platini93@tankertelz(.)co>
수신자:@tutanota(.)com
제목: Mail Delivery error in @tutanota(.)com on 5/16/2024 5:48:39 a.m.
메시지 ID: <20240516054839.34FB7B9BD87DF1DD@tankertelz(.)co>
MIME-Version: 1.0

투타노타 피싱 사이트

요약

이메일은 tankertelz(.)co 도메인의 서버(mail5.tankertelz(.)co)에서 발송되었으며 SPF와 DKIM 검증을 통과
DMARC 정책에 따라 중립(dis=neutral)으로 처리되었으며 tutanota(.)com으로 발송된 메일
tutanota.com 주소를 사용하지만, 실제 도메인은 tankertelz(.)co이므로 피싱 100%
이메일 보낸 시간대는 2024년 5월 16일 05:48:40 (CEST)

HTTP Debugger Pro 로 개인정보 전송

피싱 사이트 주소

https://cloudflare-ipfs(.)com/ipfs/bafybeihsrplwtbc4mw(m)pf24z4atzvgndxklwaxcl7
dyafxa2ozzf2z2a2m/bats.html/#@tutanota.com ->
https://edeaskates(.)co/live/band(.)php

으로 진행이 됩니다.
즉 기본적인 보안 수칙을 잘 지키는 습관을 가져야 할 것입니다.