Selçuk Bey Merhaba;
Cevap için teşekkür ederim.
İnternet Headers bilgileri ekteki dosya da mevcuttur.
________________________________
Gönderen: Selcuk Demiray <[email protected]> adına Liste
<[email protected]>
Gönderildi: 12 Haziran 2019 Çarşamba 11:10
Kime: [email protected]
Konu: Re: [NetsecTR] Yapı Kredi Bankası sahte mailler
Merhaba,
Outlook da mail içindeyken File-Properties kısmından İnternet Headers'a bakarak
aslında nerden gönderildiğini tespit edebilirsiniz. Verdiğiniz örnek Yapı
Krediden gönderilmiş gibi hazırlanmıştır. (Spoof edilmiş)
Bilgilerinize.
12 Haz 2019 Çar, saat 10:44 tarihinde Cihan ACAR
<[email protected]<mailto:[email protected]>> şunu yazdı:
Merhaba;
Yapı kredi bankası hakkında virüs lü mailler geliyor.
Adres ise
[email protected]<mailto:[email protected]>
Filtreleme yaparken nelere dikkat etmeliyiz bu tür zararlı e-postalara karşı?
Teşekkürler
Cihan ACAR
https://i.hizliresim.com/LvYzEj.jpg ( Outlook görüntüsü )
-------------------------------------------------
Ücretsiz Phishing Domain Tespiti ve Alarm Servisi -
https://services.normshield.com/phishing-domain-search
-------------------------------------------------
ÿþR e c e i v e d : f r o m d u d e . y o r u n g e . c o m . t r
[ 2 1 3 . 1 4 3 . 2 5 4 . 4 0 ] b y g l o b a l m e d y a . c o m
w i t h E S M T P
( S M T P D - 1 2 . 5 . 5 . 7 8 ) i d
6 6 2 7 0 0 0 3 d 7 1 1 7 0 5 5 ; T u e , 1 1 J u n 2 0 1 9
0 9 : 0 6 : 3 8 + 0 3 0 0
X - S p a m - S t a t u s : N o
X - Y o r u n g e - M a i l S c a n n e r - E F A - W a t e r m a r k :
1 5 6 0 8 3 7 9 4 4 . 9 8 7 1 3 @ 8 w e 9 d E p l G K C t 5 W 6 E E U p e O g
X - Y o r u n g e - M a i l S c a n n e r - E F A - F r o m :
y a p i k r e d i @ i l e t i s i m . y a p i k r e d i . c o m . t r
X - Y o r u n g e - M a i l S c a n n e r - E F A - S p a m S c o r e : s
X - Y o r u n g e - M a i l S c a n n e r - E F A : F o u n d t o b e
c l e a n
X - Y o r u n g e - M a i l S c a n n e r - E F A - I D :
0 7 5 5 E 1 0 0 1 B 0 . A 1 3 C 5
X - Y o r u n g e - M a i l S c a n n e r - E F A - I n f o r m a t i o n :
P l e a s e c o n t a c t e f a @ y o r u n g e . c o m . t r f o r
m o r e i n f o r m a t i o n
R e c e i v e d : f r o m p l e s k . o r k a h o l d i n g . c o m
( c r m . d a m a t t w e e n . c o m [ 2 1 3 . 1 4 3 . 2 5 4 . 1 4 7 ] )
( u s i n g T L S v 1 . 2 w i t h c i p h e r
E C D H E - R S A - A E S 2 5 6 - G C M - S H A 3 8 4 ( 2 5 6 / 2 5 6
b i t s ) )
( N o c l i e n t c e r t i f i c a t e r e q u e s t e d )
b y d u d e . y o r u n g e . c o m . t r ( P o s t f i x ) w i t h
E S M T P S i d 0 7 5 5 E 1 0 0 1 B 0 ;
T u e , 1 1 J u n 2 0 1 9 0 9 : 0 5 : 2 2 + 0 3 0 0 ( + 0 3 )
R e c e i v e d : f r o m w e b m a i l . o r k a o r s a n . c o m
( l o c a l h o s t [ I P v 6 : : : 1 ] )
b y p l e s k . o r k a h o l d i n g . c o m ( P o s t f i x ) w i t h
E S M T P S A i d 8 F E 9 7 B 2 5 A 6 9 ;
T u e , 1 1 J u n 2 0 1 9 0 9 : 0 5 : 2 1 + 0 3 0 0 ( + 0 3 )
A u t h e n t i c a t i o n - R e s u l t s : p l e s k ;
s p f = p a s s ( s e n d e r I P i s : : 1 )
s m t p . m a i l f r o m = y a p i k r e d i @ i l e t i s i m . y a p i k r e d i . c o m . t r
s m t p . h e l o = w e b m a i l . o r k a o r s a n . c o m
R e c e i v e d - S P F : p a s s ( p l e s k : c o n n e c t i o n
i s a u t h e n t i c a t e d )
M I M E - V e r s i o n : 1 . 0
C o n t e n t - T y p e : m u l t i p a r t / m i x e d ;
b o u n d a r y = " = _ 0 6 f 6 4 f c e a e 8 e 2 d f a b 2 e 9 e f d 4 e 4 d 6 7 b b b "
D a t e : T u e , 1 1 J u n 2 0 1 9 0 7 : 0 5 : 2 1 + 0 1 0 0
F r o m : " Y a p i v e K r e d i B a n k a s i A . S . "
< y a p i k r e d i @ i l e t i s i m . y a p i k r e d i . c o m . t r >
T o : u n d i s c l o s e d - r e c i p i e n t s : ;
S u b j e c t : [ v i r u s b i r d e n c o k t e h d i t ] G u n
i c i c e k s t a t u b i l d i r i m i
R e p l y - T o : " Y a p i v e K r e d i B a n k a s i A . S . "
< k e s h k e s h 1 2 @ y a h o o . c o m >
M a i l - R e p l y - T o : " Y a p i v e K r e d i B a n k a s i
A . S . " < k e s h k e s h 1 2 @ y a h o o . c o m >
I n - R e p l y - T o :
< 9 4 f 1 2 5 b c d 1 8 4 8 f d b a 9 1 1 6 e f f 9 e 4 0 e 9 a 6 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
R e f e r e n c e s :
< d b 2 e 8 3 9 7 7 d c 2 1 e a 9 4 9 7 0 c 6 7 7 9 2 9 6 f d d 8 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 8 0 8 4 7 6 0 b 8 e c b c 3 3 e d d c 9 0 d 5 0 3 6 6 2 1 7 e e @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 3 a d 8 7 0 5 7 6 2 2 2 5 9 a 5 1 b 0 9 1 6 0 c b 8 8 d a a 4 2 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 0 6 1 d 2 9 8 7 0 0 f d 5 6 9 1 d 7 6 7 0 d f 2 f 0 5 6 5 1 8 6 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 2 a b 7 b c 8 a 6 b 9 6 b e a 6 4 b b 3 7 8 1 f 9 1 a 2 c c 5 e @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 8 a f 5 6 e 0 f 8 4 d 1 1 a 5 c 9 9 5 e 8 f 9 6 9 a 6 5 d a 5 b @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< f 4 1 6 b 5 4 6 9 5 3 8 1 b 5 9 f c e c 4 4 3 2 7 4 2 3 b 1 0 9 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 7 8 1 8 4 c 0 8 f a 6 6 6 3 0 6 5 4 d 2 c 9 b 0 f 5 f 8 7 5 4 0 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< e c a 0 9 9 9 f f 9 d d d c 8 5 0 a 6 6 e c 1 e e 6 2 e 6 1 5 d @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< c 3 8 3 3 d d 2 9 8 8 5 4 6 2 8 5 b 7 1 a 0 8 b 1 a 0 b d e 0 7 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 6 0 5 3 3 a 8 f f 6 1 7 a f 6 2 3 a 9 5 f c d 2 5 d 7 8 2 0 c 3 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 0 0 6 8 7 1 e c 1 6 4 5 3 6 5 5 c 0 a 8 1 2 a a 4 c 5 2 f 8 7 c @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 8 a 5 6 c d a 6 2 0 6 c a 9 9 e 7 9 2 a 3 7 0 f d f 8 8 d 9 a 7 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 8 c 6 f 0 4 7 4 9 2 1 3 1 2 8 5 d f b 0 1 1 7 4 9 e 5 d 6 1 c 4 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 5 2 a a 9 7 8 2 9 d a c 7 8 5 5 1 b 9 a 2 e 2 e a c 8 e 8 0 f a @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< c 5 3 5 d d a 0 b b 1 e a 0 8 b b b 9 8 4 b b 9 2 1 3 b 1 7 7 d @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< f 2 0 4 8 3 c f f 5 5 6 1 a d b 0 6 f f 8 0 2 0 d a 1 9 0 2 0 9 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 7 3 2 2 7 2 e 8 4 7 5 9 b 9 2 a 2 7 6 7 c 7 9 4 8 5 2 c b 1 2 6 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 6 b e 1 c 7 c 8 9 a f 9 f a f 5 e 0 7 4 4 8 6 7 6 6 8 5 a 6 5 7 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 9 a e d 5 c e f d 7 f 3 d e 7 3 6 b 0 9 e c f d d 3 f 8 1 d e c @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< e 0 0 d 1 b 0 6 c 0 3 4 0 a c 5 8 c 4 e c 3 a 6 1 6 4 7 0 b 7 f @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 2 7 2 a 2 6 9 5 9 b b 0 f 7 3 3 5 c a e b 9 0 a b 3 f b 1 d d 0 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 5 2 c 6 2 a a c 9 a 5 e b b 5 1 c c e b 5 b 3 5 c 9 4 d 8 a 6 1 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 2 c 1 8 b 2 3 0 a f c 0 6 9 e e 6 8 8 f 1 3 e 5 1 1 7 7 c 3 0 6 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< d 1 e 2 e 2 4 1 8 2 6 8 4 f 9 3 1 2 8 f 0 d 5 e a b e 1 2 d a f @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 7 7 f 9 1 6 0 8 4 5 d c 2 5 5 3 6 4 3 8 2 1 b 8 e 0 f d 1 3 8 d @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< a d 9 6 b e f 3 f e 6 f 9 3 9 8 f 9 7 a c 2 2 7 6 a 5 b 4 8 a 3 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 7 3 1 0 3 4 7 a 0 5 1 9 4 2 2 e 5 9 2 c 4 a 0 6 0 7 7 3 7 d a d @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< c d 5 d 9 4 3 a 4 b 7 3 0 0 7 7 6 a 4 c f 9 e a 9 3 4 1 a 1 5 2 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 8 6 4 3 5 c 2 7 a d e 2 8 f a 0 3 8 b d f 2 6 d 2 9 7 e 5 3 f 2 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 3 a c 7 f e 8 9 7 c 6 0 5 7 b 1 6 c 8 d 0 e 7 4 9 a 8 2 3 9 b 5 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 3 7 5 2 8 b 6 e a b 8 6 e 1 8 1 f 3 2 4 0 8 2 b 6 6 a 2 2 2 0 5 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 5 a 6 6 3 a b 2 f d b 8 5 4 9 1 2 9 5 b c e a f c e 6 6 6 4 7 a @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 6 3 c 6 6 2 f 0 1 d 8 3 f 3 6 8 8 c 0 1 b f c 6 5 8 d d 6 3 1 9 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 0 0 1 e 8 4 5 1 d 0 0 f 5 f 0 e b d 5 5 e 2 8 2 e f b 9 a f 5 e @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 8 d 3 f 3 5 3 a 0 d d 1 f 6 7 7 c 1 5 d 0 7 0 e 9 e f e f 7 a 8 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< e d c 9 5 8 5 1 d 9 8 e e 0 0 b 6 e 6 8 d 2 1 4 0 d d 8 b 7 a 2 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 7 e a a d 5 0 d 0 9 0 5 a 5 8 5 b 8 8 8 d 2 c e d 7 e c b 8 3 a @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 9 8 a a 4 c 3 b d 9 7 4 2 6 3 b 8 0 6 5 f d 8 e 1 8 8 3 3 c 4 4 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 9 4 c 8 c e 6 f b c 9 0 3 5 c a 9 0 e 8 2 6 c 0 f a 5 c d b 3 3 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 4 7 d a d 2 f 9 5 5 c 8 2 5 9 5 c 1 c b 7 7 f 6 9 a 7 b 6 0 5 4 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 7 d b 5 a d 4 f 3 1 f 9 2 d d 9 3 4 0 6 7 8 5 0 f e 6 c 2 9 8 8 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 5 b 5 2 2 a a d 3 f c 3 b a 1 d 3 7 b c d f 9 d 4 7 6 d c 0 6 a @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 8 5 3 4 8 f 8 d 0 0 3 a 6 3 5 e 5 3 0 6 3 4 1 f c 0 3 c b 2 4 2 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 2 7 2 6 4 9 8 e 4 0 0 4 8 0 7 7 a b 6 6 4 2 7 2 4 7 5 f 6 7 3 c @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 8 6 c 3 b 8 2 9 3 5 e 3 4 7 a a b d 2 8 3 2 f c 6 6 6 7 6 4 e 0 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 8 2 8 9 6 f 9 d c f 0 2 6 a 0 d f 5 7 a 0 d 0 8 5 a 2 5 2 c f 3 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< d d 3 9 8 d 6 f 4 c 8 4 c 0 5 0 4 b d 4 6 b a d d 7 d e d 3 2 6 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 8 5 5 8 5 b d 5 8 a 0 6 8 b 9 2 a c 3 4 8 9 d 5 f 2 a 3 9 c b 3 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 2 0 0 c 8 5 e 5 a 9 c c b 4 5 0 f c 5 4 f c 0 a 8 d 2 9 2 d 1 4 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 3 0 e 3 6 a 7 6 0 9 4 1 f 5 6 9 e d 7 8 5 b 3 d 7 d 1 f 0 1 9 a @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 5 3 b 5 0 4 7 f 3 2 2 f 7 d 2 5 b 0 c 5 a 9 0 c a d e 0 7 a 1 9 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 5 7 4 f b 9 2 e 0 3 a 4 d 1 1 1 3 9 a 7 0 8 e 5 3 d c 7 8 a 1 6 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< b d c c 3 d 2 9 4 d e f 8 7 c 9 3 0 4 0 b 7 6 d f 6 1 f 9 1 e d @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 3 3 2 7 4 a a 5 a 7 1 a 4 f 6 0 a 5 3 b 3 6 e 4 8 0 6 d e 6 c 6 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 9 4 d 6 0 e 2 5 0 8 3 6 8 6 b f e 8 d c c 2 0 5 b 8 a 9 f 0 c 2 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 3 6 1 8 a d c e 8 a b a b 9 6 4 6 7 e 4 a e 3 b 5 4 0 7 4 3 1 0 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 1 9 f d a 8 a 7 1 f 4 7 6 5 6 3 5 a 9 8 a 9 c 3 c 0 c f a 2 b c @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 3 5 0 2 0 1 7 0 a 1 d 6 a 1 e 4 9 6 6 2 d 7 5 e d d 6 6 0 8 c 0 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 0 f b b 5 0 3 c d a 7 8 a 9 7 d d e 7 3 a 4 f e 5 1 8 7 a 5 c e @ i l e t i s i m . y a p i k r e d i . c o m . t r >
< 9 4 f 1 2 5 b c d 1 8 4 8 f d b a 9 1 1 6 e f f 9 e 4 0 e 9 a 6 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
M e s s a g e - I D :
< 8 3 5 d 8 7 4 2 5 1 b 3 d 6 9 1 5 5 1 1 f 8 0 d c 4 c 0 e a 3 9 @ i l e t i s i m . y a p i k r e d i . c o m . t r >
X - S e n d e r :
y a p i k r e d i @ i l e t i s i m . y a p i k r e d i . c o m . t r
U s e r - A g e n t : R o u n d c u b e W e b m a i l / 1 . 3 . 8
X - I M A I L - D o m a i n K e y s : ( 6 6 2 7 0 0 0 3 d 7 1 1 7 0 5 5 )
N o S i g n a t u r e
X - R C P T - T O : < * * * * * >
S t a t u s : `
X - U I D L : 8 6 0 2 3 3 2 0 4
X - I M a i l - T h r e a d I D : 6 6 2 7 0 0 0 3 d 7 1 1 7 0 5 5
X - E s e t R e s u l t : c l e a n ( c l e a n e d ) ,
c o n t a i n e d m u l t i p l e t h r e a t s
X - E s e t I d :
2 6 3 6 6 E 2 C 2 7 D 0 3 F 6 7 3 C 7 E 3 1 3 0 7 5 C F 3 9 6 7 6 1 7 4 6 5 7 C 2 A
-------------------------------------------------
Ücretsiz Phishing Domain Tespiti ve Alarm Servisi -
https://services.normshield.com/phishing-domain-search
-------------------------------------------------
