• 07-07-2023, 02:44:55
    #1
    herkese iyi forumlar,

    Bugün sürekli mail geliyor ziraat bankası kurumsal mail adresini kullanarak banka pdf html vb dosyaları indirmemi istiyor.Mail üst bilgilerini kontrol ettim ama kimden geldiğini anlamaya calişıyorum.

    Return-Path: <ziraatbank@ileti.ziraatbank.com.tr>
    Delivered-To: info@xxx.com
    Received: from xxx.xxx.net.tr
    by cpanel12.xxx.net.tr with LMTP
    id cME2FUoNk2TK3QYA73N2Dg
    (envelope-from <ziraatbank@ileti.ziraatbank.com.tr>)
    for <info@xxx.com>; Wed, 21 Jun 2023 17:46:34 +0300
    Return-path: <ziraatbank@ileti.ziraatbank.com.tr>
    Envelope-to: info@xxx.com
    Delivery-date: Wed, 21 Jun 2023 17:46:34 +0300
    Received: from ptr131161.lhost7.websahibi.net ([213.142.131.161]:51392 helo=lhost7.websahibi.net)
    by cpanel12.xxx.net.tr with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    (Exim 4.96)
    (envelope-from <ziraatbank@ileti.ziraatbank.com.tr>)
    id 1qBz6R-001szy-1p
    for info@xxx.com;
    Wed, 21 Jun 2023 17:46:34 +0300
    Received: from webmail.erkayapazarlama.com.tr (localhost.localdomain [127.0.0.1])
    by lhost7.websahibi.net (Postfix) with ESMTPSA id 83F5718A971D8;
    Wed, 21 Jun 2023 17:19:08 +0300 (+03)
    Authentication-Results: lhost7.websahibi.net;
    spf=pass (sender IP is 127.0.0.1) smtp.mailfrom=ziraatbank@ileti.ziraatbank.com.tr smtp.helo=webmail.erkayapazarlama.com.tr
    Received-SPF: pass (lhost7.websahibi.net: connection is authenticated)
    MIME-Version: 1.0
    Date: Wed, 21 Jun 2023 15:19:08 +0100
    From: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
    To: undisclosed-recipients:;
    Subject: e-dekont
    User-Agent: Roundcube Webmail/1.4.13
    Message-ID: <5bfa3ccb4c5d95fceec7d2a8a6acfe9b@ileti.ziraatbank .com.tr>
    X-Sender: ziraatbank@ileti.ziraatbank.com.tr
    Content-Type: multipart/mixed;
    boundary="=_1c63343aa5d87d097f3bfb879a2de0a1"
    X-PPP-Message-ID:
    <168735715032.17285.5055291751955731059@lhost7.web sahibi.net>
    X-PPP-Vhost: erkayapazarlama.com.tr
    X-From-Rewrite: unmodified, no actual sender determined from check mail permissions
  • 07-07-2023, 03:43:34
    #2
    dns spoof ediliyor çok büyük ihtimalle