{"id":1100,"date":"2026-11-01T17:08:36","date_gmt":"2026-11-01T17:08:36","guid":{"rendered":"https:\/\/www.vps.tc\/blog\/?p=1100"},"modified":"2026-11-01T09:26:45","modified_gmt":"2026-11-01T09:26:45","slug":"oltalama-nedir-sahte-epostalari-tanima","status":"publish","type":"post","link":"https:\/\/www.vps.tc\/blog\/tr\/oltalama-nedir-sahte-epostalari-tanima\/","title":{"rendered":"Oltalama (Phishing) Nedir? Sahte E-postalar\u0131 Tan\u0131y\u0131n"},"content":{"rendered":"<div class=\"aiw-summary\" id=\"aiw-ozet\">\n<p class=\"aiw-summary-title\">H\u0131zl\u0131 \u00d6zet &#8211; Sahte Yenileme E-postalar\u0131n\u0131 Tan\u0131mak<\/p>\n<p>Oltalama, g\u00fcvenilir bir taraf\u0131 taklit ederek bilgi, \u00f6deme veya hesap eri\u015fimi elde etmeye \u00e7al\u0131\u015fan sald\u0131r\u0131d\u0131r. A\u015fa\u011f\u0131daki kontroller, ger\u00e7ek m\u00fc\u015fteri veya olay i\u00e7ermeyen varsay\u0131msal bir domain yenileme mesaj\u0131n\u0131 temel al\u0131r.<\/p>\n<ul>\n<li><strong>Aciliyet kan\u0131t de\u011fildir<\/strong> \u2014 Domainin bug\u00fcn kapanaca\u011f\u0131 iddias\u0131n\u0131, mesajdaki \u00f6deme talebinden ba\u011f\u0131ms\u0131z olarak bilinen m\u00fc\u015fteri panelinden do\u011frulay\u0131n.<\/li>\n<li><strong>G\u00f6r\u00fcnen ad\u0131 ay\u0131r\u0131n<\/strong> \u2014 Varsay\u0131msal mesajdaki yenileme@example.net adresi, beklenen yenileme@example.com adresiyle ayn\u0131 de\u011fildir; adres fark\u0131n\u0131 di\u011fer i\u015faretlerle birlikte de\u011ferlendirin.<\/li>\n<li><strong>Alan ad\u0131n\u0131 okuyun<\/strong> \u2014 https:\/\/panel.example.com.example.net\/yenileme adresi, tan\u0131d\u0131k panel ad\u0131n\u0131 i\u00e7erse de example.net alan ad\u0131na ba\u011fl\u0131d\u0131r.<\/li>\n<li><strong>Do\u011frulaman\u0131n s\u0131n\u0131r\u0131n\u0131 bilin<\/strong> \u2014 SPF, DKIM ve DMARC kontrollerinin ge\u00e7mesi, ileti i\u00e7eri\u011finin veya \u00f6deme talebinin g\u00fcvenilir oldu\u011funu kan\u0131tlamaz.<\/li>\n<li><strong>\u0130letiyi yerelde inceleyin<\/strong> \u2014 Orijinal .eml dosyas\u0131n\u0131 koruyun; HTML i\u00e7eri\u011fini g\u00f6r\u00fcnt\u00fclemeden ba\u015fl\u0131klar\u0131 incelemek i\u00e7in ba\u011flant\u0131 a\u00e7man\u0131z veya ek \u00e7al\u0131\u015ft\u0131rman\u0131z gerekmez.<\/li>\n<li><strong>\u0130\u015fleme g\u00f6re m\u00fcdahale<\/strong> \u2014 Ba\u011flant\u0131y\u0131 a\u00e7mak, parola girmek, OAuth izni vermek, \u00f6deme yapmak ve dosya \u00e7al\u0131\u015ft\u0131rmak farkl\u0131 m\u00fcdahale ad\u0131mlar\u0131 gerektirir.<\/li>\n<\/ul>\n<\/div>\n<p class=\"aiw-lead\">&quot;Domaininiz bug\u00fcn kapanacak&quot; diyen bir e-posta, \u00f6deme yapman\u0131z gerekti\u011finin kan\u0131t\u0131 de\u011fildir. Oltalama, g\u00fcvenilir bir kurulu\u015fu taklit ederek parolan\u0131z\u0131, \u00f6demenizi veya hesap eri\u015fiminizi ele ge\u00e7irmeye \u00e7al\u0131\u015fan sald\u0131r\u0131d\u0131r. Sahte mesajlar\u0131 tan\u0131mak i\u00e7in g\u00f6nderen adresini ve ba\u011flant\u0131n\u0131n ger\u00e7ek alan ad\u0131n\u0131 inceleyin; yenileme ihtiyac\u0131n\u0131 mesajdan ba\u011f\u0131ms\u0131z, bildi\u011finiz m\u00fc\u015fteri panelinden do\u011frulay\u0131n.<\/p>\n<div class=\"aiw-toc\" style=\"border:1px solid #dbe3ea;border-radius:8px;padding:16px 20px;margin:0 0 28px\">\n<p class=\"aiw-toc-head\"><strong>\u0130\u00e7indekiler<\/strong><span class=\"aiw-toc-meta\"> \u00b7 15 dk okuma<\/span><\/p>\n<ol style=\"margin:10px 0 0;padding-left:22px\">\n<li><a href=\"#domaininiz-bugun-kapanacak-diyen-mesaj\">Domaininiz bug\u00fcn kapanacak diyen mesaj<\/a><\/li>\n<li><a href=\"#gonderen-adi-ile-e-posta-adresi-ayni-sey-degil\">G\u00f6nderen ad\u0131 ile e-posta adresi ayn\u0131 \u015fey de\u011fil<\/a><\/li>\n<li><a href=\"#baglantida-gercekten-hangi-alan-adina-gidiyorsunuz\">Ba\u011flant\u0131da ger\u00e7ekten hangi alan ad\u0131na gidiyorsunuz?<\/a><\/li>\n<li><a href=\"#spf-dkim-ve-dmarc-neyi-dogrular\">SPF, DKIM ve DMARC neyi do\u011frular?<\/a><\/li>\n<li><a href=\"#supheli-iletiyi-acmadan-teknik-izleri-incelemek\">\u015e\u00fcpheli iletiyi a\u00e7madan teknik izleri incelemek<\/a><\/li>\n<li><a href=\"#yenileme-talebini-e-postadan-bagimsiz-dogrulayin\">Yenileme talebini e-postadan ba\u011f\u0131ms\u0131z do\u011frulay\u0131n<\/a><\/li>\n<li><a href=\"#tikladiysaniz-sonraki-adim-yapilan-isleme-bagli\">T\u0131klad\u0131ysan\u0131z sonraki ad\u0131m yap\u0131lan i\u015fleme ba\u011fl\u0131<\/a><\/li>\n<li><a href=\"#yenileme-odemesinden-once-kontrol-edin\">Yenileme \u00d6demesinden \u00d6nce Kontrol Edin<\/a><\/li>\n<li><a href=\"#sik-sorulan-sorular\">S\u0131k Sorulan Sorular<\/a><\/li>\n<li><a href=\"#kaynaklar\">Kaynaklar<\/a><\/li>\n<\/ol>\n<\/div>\n<h2 id=\"domaininiz-bugun-kapanacak-diyen-mesaj\">Domaininiz bug\u00fcn kapanacak diyen mesaj<\/h2>\n<p><strong>Varsay\u0131msal senaryo:<\/strong> <code>yonetici@example.com<\/code> adresine, konu sat\u0131r\u0131nda &#8220;Domaininiz bug\u00fcn kapanacak&#8221; yazan bir e-posta geliyor. Yenileme \u00fccretinin hemen \u00f6denmesini istiyor; aksi durumda sitenin yay\u0131ndan kald\u0131r\u0131laca\u011f\u0131n\u0131 ve m\u00fc\u015fteri paneline eri\u015fimin kapat\u0131laca\u011f\u0131n\u0131 s\u00f6yl\u00fcyor. G\u00f6r\u00fcnen g\u00f6nderen ad\u0131 domain sa\u011flay\u0131c\u0131s\u0131n\u0131 taklit ediyor. Bekleyen i\u015fler aras\u0131nda dikkatiniz, mesaj\u0131n ger\u00e7ekli\u011finden \u00e7ok sitenizi ayakta tutmaya kayabilir. Acele etmeyin. \u0130letinin kurdu\u011fu bask\u0131, do\u011frulama ad\u0131m\u0131n\u0131 atlay\u0131p \u00f6deme d\u00fc\u011fmesine basman\u0131z\u0131 hedefliyor.<\/p>\n<p><strong>Oltalama nedir?<\/strong> G\u00fcvenilir bir ki\u015fi veya kurumu taklit ederek bilgi, \u00f6deme ya da hesap eri\u015fimi elde etmeye \u00e7al\u0131\u015fan sald\u0131r\u0131d\u0131r. CISA, oltalama mesajlar\u0131n\u0131n kullan\u0131c\u0131lar\u0131 zararl\u0131 ba\u011flant\u0131lar\u0131 a\u00e7maya, ekleri indirmeye veya ki\u015fisel bilgilerini payla\u015fmaya y\u00f6nlendirebildi\u011fini belirtiyor. Buradaki yenileme bahanesi de ayn\u0131 g\u00fcven ili\u015fkisini kullan\u0131yor: Domaininizi y\u00f6netti\u011finiz \u015firketten geldi\u011fini d\u00fc\u015f\u00fcnd\u00fc\u011f\u00fcn\u00fcz talep, sorgulayaca\u011f\u0131n\u0131z bir \u00f6demeyi s\u0131radan bir i\u015flem gibi g\u00f6sterebilir. Bunun i\u00e7in sald\u0131rgan\u0131n sa\u011flay\u0131c\u0131n\u0131z\u0131n sistemlerine eri\u015fmi\u015f olmas\u0131 gerekmez.<\/p>\n<p>Bu \u00f6rnekte me\u015fru g\u00f6nderici adresi <code>yenileme@example.com<\/code>, bilinen m\u00fc\u015fteri paneli <code>https:\/\/panel.example.com<\/code>. \u015e\u00fcpheli iletinin ger\u00e7ek <code>From<\/code> adresi ise <code>yenileme@example.net<\/code>; \u00f6deme i\u00e7in sundu\u011fu ba\u011flant\u0131 <code>https:\/\/panel.example.com.example.net\/yenileme<\/code>. Bu de\u011ferler, ger\u00e7ek bir m\u00fc\u015fteri olay\u0131na de\u011fil, e\u011fitim amac\u0131yla olu\u015fturulmu\u015f tek bir senaryoya aittir. <code>example.net<\/code> yaln\u0131zca senaryoda \u015f\u00fcpheli taraf\u0131 temsil eder; alan ad\u0131 hakk\u0131nda ger\u00e7ek bir k\u00f6t\u00fcye kullan\u0131m iddias\u0131 yoktur.<\/p>\n<p>Mesajdaki bask\u0131 \u00fc\u00e7 par\u00e7adan olu\u015fuyor. &#8220;Bug\u00fcn&#8221; ifadesi d\u00fc\u015f\u00fcnme s\u00fcresini daralt\u0131yor, hesap kapatma tehdidi kay\u0131p korkusunu b\u00fcy\u00fct\u00fcyor, \u00f6deme talebi bu korkudan \u00e7\u0131k\u0131\u015f yolu olarak sunuluyor. CISA&#8217;n\u0131n tan\u0131ma \u00f6nerilerinde acil veya duygusal dil, \u015f\u00fcpheli g\u00f6nderen adresleri ve ki\u015fisel ya da finansal bilgi talepleri uyar\u0131 i\u015faretleri aras\u0131nda yer al\u0131yor. D\u00fczg\u00fcn T\u00fcrk\u00e7e, tan\u0131d\u0131k bir logo veya profesyonel imza bu i\u015faretleri ortadan kald\u0131rmaz.<\/p>\n<p>Ger\u00e7ek yenileme bildirimleri de son tarih ve \u00f6deme bilgisi i\u00e7erebilir. Yaln\u0131zca sert bir konu sat\u0131r\u0131ndan kesin h\u00fck\u00fcm \u00e7\u0131karmay\u0131n; talebin kimden geldi\u011fini ve hangi i\u015fleme y\u00f6nlendirdi\u011fini birlikte de\u011ferlendirin. Mesaj, kendi iddias\u0131n\u0131n kan\u0131t\u0131 de\u011fildir. \u0130letide yazan kapanma saati de sa\u011flay\u0131c\u0131n\u0131n ger\u00e7ekten b\u00f6yle bir i\u015flem planlad\u0131\u011f\u0131n\u0131 tek ba\u015f\u0131na g\u00f6stermez.<\/p>\n<p><strong>\u015e\u00fcpheli bir e-posta almak, hesab\u0131n\u0131z\u0131n ele ge\u00e7irildi\u011fini kan\u0131tlamaz.<\/strong> Mesaj\u0131n ula\u015fmas\u0131 ile ba\u011flant\u0131ya bilgi girmeniz veya \u00f6deme yapman\u0131z farkl\u0131 durumlard\u0131r. \u0130lk karar\u0131n\u0131z\u0131 iletinin koydu\u011fu s\u00fcreye g\u00f6re vermeyin; yenileme durumunu e-postadaki d\u00fc\u011fmeden de\u011fil, \u00f6nceden bildi\u011finiz m\u00fc\u015fteri panelinden kontrol edin.<\/p>\n<div class=\"aiw-callout aiw-callout-warn\">\n<p class=\"aiw-callout-label\">Dikkat<\/p>\n<p>Varsay\u0131msal senaryoda domainin ger\u00e7ekten yenilenmesi gerekse bile e-postadaki \u00f6deme ba\u011flant\u0131s\u0131 g\u00fcvenilir hale gelmez. Mesajdaki telefon, yan\u0131t adresi veya ba\u011flant\u0131 yerine \u00f6nceden kaydetti\u011finiz destek kanal\u0131n\u0131 kullan\u0131n.<\/p>\n<\/div>\n<h2 id=\"gonderen-adi-ile-e-posta-adresi-ayni-sey-degil\">G\u00f6nderen ad\u0131 ile e-posta adresi ayn\u0131 \u015fey de\u011fil<\/h2>\n<p>Gelen kutusunda &#8220;Example Domain Sa\u011flay\u0131c\u0131s\u0131&#8221; yazarken ayr\u0131nt\u0131larda bamba\u015fka bir adres bulunabilir. Ad yeterli de\u011fil. G\u00f6r\u00fcnen ad, g\u00f6nderenin belirleyebildi\u011fi bir etikettir; kurumun kimli\u011fini do\u011frulamaz. \u00d6zellikle mobil istemcilerde adresin tamam\u0131 ilk ekranda g\u00f6r\u00fcnmeyebilir. G\u00f6nderen ayr\u0131nt\u0131lar\u0131n\u0131 geni\u015fleterek etiketi ve e-posta adresini ayr\u0131 ayr\u0131 okuyun; tan\u0131d\u0131k isim, bu kontrol\u00fc atlamak i\u00e7in gerek\u00e7e de\u011fildir.<\/p>\n<p>A\u015fa\u011f\u0131daki ham ileti kesiti, ger\u00e7ek ki\u015fisel veri i\u00e7ermeyen <strong>varsay\u0131msal domain yenileme senaryosuna<\/strong> aittir. Ubuntu Server 24.04 LTS ortam\u0131ndaki <code>\/home\/analist\/phishing-lab\/supheli.eml<\/code> dosyas\u0131nda tutulacak sentetik iletinin ilgili ba\u015fl\u0131klar\u0131n\u0131 ve g\u00f6vdesini g\u00f6sterir. <code>example.net<\/code> yaln\u0131zca senaryodaki \u015f\u00fcpheli taraf\u0131 temsil eder; ger\u00e7ek bir k\u00f6t\u00fcye kullan\u0131m iddias\u0131 ta\u015f\u0131maz.<\/p>\n<pre><code>From: \"Example Domain Saglayicisi\" &lt;yenileme@example.net&gt;\nTo: yonetici@example.com\nReply-To: yenileme@example.net\nReturn-Path: &lt;yenileme@example.net&gt;\nSubject: Domain yenileme icin hesap dogrulamasi\nMIME-Version: 1.0\nContent-Type: text\/plain; charset=UTF-8\n\nBu, analiz amacli varsayimsal bir iletidir.\nDomain yenilemeniz icin hesabinizi dogrulayin:\nhttps:\/\/panel.example.com.example.net\/yenileme\n<\/code><\/pre>\n<p>Bu blok \u00e7al\u0131\u015ft\u0131r\u0131lacak komut de\u011fil, incelenecek veridir. \u0130stemcide beklenen g\u00f6r\u00fcn\u00fcm &#8220;Example Domain Saglayicisi&#8221; etiketi ve ayr\u0131nt\u0131larda <code>yenileme@example.net<\/code> adresidir; g\u00f6sterim uygulamaya g\u00f6re de\u011fi\u015febilir. Bilinen me\u015fru g\u00f6nderici <code>yenileme@example.com<\/code> oldu\u011fundan adres uyu\u015fmazl\u0131\u011f\u0131 vard\u0131r. Ayr\u0131ca \u015f\u00fcpheli iletideki \u00fc\u00e7 adres alan\u0131n\u0131n birbirini tutmas\u0131, g\u00f6nderenin me\u015fru oldu\u011funu kan\u0131tlamaz.<\/p>\n<ul>\n<li><strong>G\u00f6r\u00fcnen ad:<\/strong> G\u00f6nderen sat\u0131r\u0131ndaki etikettir. Marka ad\u0131n\u0131n kopyalanmas\u0131 kolayd\u0131r.<\/li>\n<li><strong>From:<\/strong> \u0130letinin yazar\u0131n\u0131 belirten ba\u015fl\u0131kt\u0131r; i\u00e7indeki adres tek ba\u015f\u0131na do\u011frulanm\u0131\u015f kimlik say\u0131lmaz.<\/li>\n<li><strong>Reply-To:<\/strong> Yan\u0131t\u0131n y\u00f6nlendirilmesi istenen adresi belirtir. Yan\u0131tla d\u00fc\u011fmesi sizi beklemedi\u011finiz bir adrese g\u00f6t\u00fcrebilir.<\/li>\n<li><strong>Return-Path:<\/strong> Teslim s\u0131ras\u0131nda kaydedilen zarf d\u00f6n\u00fc\u015f adresini g\u00f6sterir. Teslim edilememe bildirimleriyle ili\u015fkilidir; normal yan\u0131t adresi de\u011fildir.<\/li>\n<\/ul>\n<p>RFC 7208, SPF denetiminde kullan\u0131lan kimliklerden birinin SMTP zarf\u0131ndaki <code>MAIL FROM<\/code> oldu\u011funu a\u00e7\u0131klar; bu adres teslim edilen iletide <code>Return-Path<\/code> alan\u0131na kaydedilir. RFC 7489 ise g\u00f6r\u00fcnen <code>From<\/code> alan ad\u0131yla do\u011frulanm\u0131\u015f alan adlar\u0131n\u0131n hizalamas\u0131n\u0131 ele al\u0131r. Ba\u015fl\u0131klar\u0131n g\u00f6revleri farkl\u0131d\u0131r &#8211; bunlar\u0131 tek bir &#8220;g\u00f6nderen adresi&#8221; gibi okumay\u0131n.<\/p>\n<p>Me\u015fru toplu g\u00f6nderim hizmetlerinde zarf d\u00f6n\u00fc\u015f adresi hizmet sa\u011flay\u0131c\u0131ya, <code>Reply-To<\/code> adresi destek ekibine ait olabilir. Farkl\u0131l\u0131k tek ba\u015f\u0131na oltalama kan\u0131t\u0131 de\u011fildir. Kurumun bilinen g\u00f6nderim d\u00fczeni, g\u00fcvenilir al\u0131c\u0131 altyap\u0131s\u0131n\u0131n do\u011frulama sonu\u00e7lar\u0131 ve mesajdaki talep birlikte de\u011ferlendirilmelidir. Adreslerin ayn\u0131 olmas\u0131 da otomatik g\u00fcven sa\u011flamaz.<\/p>\n<p>CISA, beklenmeyen ba\u011flant\u0131lar\u0131, ekleri ve ki\u015fisel bilgi taleplerini uyar\u0131 i\u015faretleri aras\u0131nda sayar. Buradaki hesap do\u011frulama iste\u011fini yenileme beklentinizle kar\u015f\u0131la\u015ft\u0131r\u0131n. \u00d6rnekte ek yoktur; b\u00f6yle bir talebe ek e\u015flik ederse a\u00e7may\u0131n veya \u00e7al\u0131\u015ft\u0131rmay\u0131n. D\u00fczg\u00fcn T\u00fcrk\u00e7e ve tan\u0131d\u0131k logo g\u00fcvenilirlik kan\u0131t\u0131 de\u011fildir. Yan\u0131t vermeden \u00f6nce bilinen <code>https:\/\/panel.example.com<\/code> adresinden yenileme durumunu kontrol edin.<\/p>\n<h2 id=\"baglantida-gercekten-hangi-alan-adina-gidiyorsunuz\">Ba\u011flant\u0131da ger\u00e7ekten hangi alan ad\u0131na gidiyorsunuz?<\/h2>\n<p>Adresin ba\u015f\u0131ndaki tan\u0131d\u0131k isim yan\u0131ltabilir. Varsay\u0131msal domain yenileme e-postas\u0131 senaryosunda bilinen m\u00fc\u015fteri paneliniz <code>https:\/\/panel.example.com<\/code>, \u015f\u00fcpheli ba\u011flant\u0131 ise <code>https:\/\/panel.example.com.example.net\/yenileme<\/code> adresidir. Hostname de\u011ferleri farkl\u0131d\u0131r. CISA, oltalama mesajlar\u0131n\u0131 tan\u0131ma \u00f6nerilerinde \u015f\u00fcpheli ba\u011flant\u0131lar\u0131 uyar\u0131 i\u015faretleri aras\u0131nda sayar; burada dikkat etmeniz gereken, tan\u0131d\u0131k metnin adresin hangi b\u00f6l\u00fcm\u00fcnde bulundu\u011fudur. Ba\u011flant\u0131n\u0131n g\u00f6r\u00fcnen yaz\u0131s\u0131 ile ger\u00e7ek hedefi de birbirinden farkl\u0131 olabilir.<\/p>\n<p><a href=\"https:\/\/www.vps.tc\/blog\/tr\/domain-ve-url-farki\/\">Domain ve URL fark\u0131<\/a>, bu kar\u015f\u0131la\u015ft\u0131rmay\u0131 kolayla\u015ft\u0131r\u0131r. URL i\u00e7indeki <code>https<\/code> \u015femay\u0131, bu \u00f6rneklerde <code>:\/\/<\/code> sonras\u0131nda gelen sunucu ad\u0131 hostname de\u011ferini, <code>\/yenileme<\/code> ise yolu belirtir. Me\u015fru adresin hostname de\u011feri <code>panel.example.com<\/code>, \u015f\u00fcpheli adresinki <code>panel.example.com.example.net<\/code> olur. \u0130kincisi <code>example.com<\/code> alt\u0131nda de\u011fildir: ba\u015ftaki tan\u0131d\u0131k etiketler, <code>example.net<\/code> alt\u0131nda olu\u015fturulmu\u015f alt alan ad\u0131 zinciridir. Bu senaryoda <code>example.net<\/code> yaln\u0131zca \u015f\u00fcpheli taraf\u0131 temsil eder.<\/p>\n<p>Hostname etiketlerini sa\u011fdan sola okuyunca <code>net<\/code> \u00fcst d\u00fczey alan ad\u0131n\u0131, solundaki <code>example<\/code> ile birlikte de <code>example.net<\/code> s\u0131n\u0131r\u0131n\u0131 g\u00f6r\u00fcrs\u00fcn\u00fcz. Ancak ger\u00e7ek adreslerde &#8220;son iki etiketi al&#8221; kural\u0131 yetmez. <code>co.uk<\/code> gibi \u00e7ok etiketli genel son ekler bulunur; kay\u0131t edilebilir alan ad\u0131n\u0131 otomatik belirlemek i\u00e7in g\u00fcncel bir genel son ek listesinden yararlan\u0131l\u0131r. Noktalar\u0131 saymak, tek ba\u015f\u0131na g\u00fcvenlik kontrol\u00fc de\u011fildir.<\/p>\n<p>Ubuntu Server 24.04 LTS \u00fczerinde a\u015fa\u011f\u0131daki kodu <code>\/home\/analist\/phishing-lab\/incele.py<\/code> dosyas\u0131na kaydedebilirsiniz. Python 3.12 standart k\u00fct\u00fcphanesindeki <code>urllib.parse<\/code>, iki sabit adresi yerel olarak ayr\u0131\u015ft\u0131r\u0131r. Kod DNS sorgulamaz, ba\u011flant\u0131lar\u0131 a\u00e7maz, ileti g\u00f6ndermez ve ek \u00e7al\u0131\u015ft\u0131rmaz; root yetkisi gerektirmez.<\/p>\n<pre><code>from urllib.parse import urlsplit\n\nadresler = (\n    \"https:\/\/panel.example.com\",\n    \"https:\/\/panel.example.com.example.net\/yenileme\",\n)\n\nfor adres in adresler:\n    parcalar = urlsplit(adres)\n    print(f\"\u015fema={parcalar.scheme}\")\n    print(f\"hostname={parcalar.hostname}\")\n    print(f\"yol={parcalar.path!r}\")\n    print()\n<\/code><\/pre>\n<p>Dosyay\u0131 \u015fu komutla \u00e7al\u0131\u015ft\u0131rabilirsiniz:<\/p>\n<pre><code>python3 \/home\/analist\/phishing-lab\/incele.py<\/code><\/pre>\n<p>A\u015fa\u011f\u0131daki beklenen \u00e7\u0131kt\u0131 koddan t\u00fcretilmi\u015f temsili g\u00f6sterimdir; \u00e7al\u0131\u015ft\u0131r\u0131lm\u0131\u015f bir test kayd\u0131 de\u011fildir. <code>!r<\/code>, yol de\u011ferini t\u0131rnaklar\u0131yla g\u00f6sterir. \u0130lk URL&#8217;deki bo\u015f yol <code>''<\/code> olarak g\u00f6r\u00fcn\u00fcr; taray\u0131c\u0131 bu adrese giderken normalde <code>\/<\/code> yolunu ister.<\/p>\n<pre><code>\u015fema=https\nhostname=panel.example.com\nyol=''\n\n\u015fema=https\nhostname=panel.example.com.example.net\nyol='\/yenileme'\n<\/code><\/pre>\n<p><code>urlsplit<\/code> g\u00fcvenilirlik karar\u0131 vermez, kay\u0131t edilebilir alan ad\u0131 s\u0131n\u0131r\u0131n\u0131 da belirlemez. HTTPS ise site sahibinin d\u00fcr\u00fcstl\u00fc\u011f\u00fcn\u00fc kan\u0131tlamaz. Sertifika do\u011frulamas\u0131 ba\u015far\u0131l\u0131 bir HTTPS ba\u011flant\u0131s\u0131 aktar\u0131m\u0131 \u015fifreler ve ba\u011flan\u0131lan hostname i\u00e7in sunucu kimlik do\u011frulamas\u0131 sa\u011flar; \u015f\u00fcpheli taraf\u0131n kendi alan ad\u0131na sertifika almas\u0131n\u0131 engellemez. \u0130ki \u00f6rne\u011fin de <code>https<\/code> ile ba\u015flamas\u0131 bu y\u00fczden aralar\u0131ndaki alan ad\u0131 fark\u0131n\u0131 ortadan kald\u0131rmaz. Yenileme d\u00fc\u011fmesinin yaz\u0131s\u0131 veya kilit simgesi yerine, ba\u011flant\u0131y\u0131 a\u00e7madan belirledi\u011finiz tam hostname de\u011ferini bilinen panel adresiyle kar\u015f\u0131la\u015ft\u0131r\u0131n.<\/p>\n<div class=\"aiw-callout aiw-callout-field\">\n<p class=\"aiw-callout-label\">Sahadan not<\/p>\n<p>Varsay\u0131msal inceleme notu &#8211; ger\u00e7ek bir saha olay\u0131 veya test sonucu de\u011fildir. Senaryodaki https:\/\/panel.example.com.example.net\/yenileme adresinde hostname panel.example.com.example.net, yol ise \/yenileme olur; tan\u0131d\u0131k panel ifadesi adresi example.com&#039;a ba\u011flamaz. example.net burada yaln\u0131zca \u015f\u00fcpheli taraf\u0131 temsil eden dok\u00fcmantasyon alan ad\u0131d\u0131r.<\/p>\n<\/div>\n<h2 id=\"spf-dkim-ve-dmarc-neyi-dogrular\">SPF, DKIM ve DMARC neyi do\u011frular?<\/h2>\n<p>\u00dc\u00e7 do\u011frulamadan ge\u00e7en bir e-posta yine de sahte yenileme talebi ta\u015f\u0131yabilir. Ayr\u0131m kritiktir. Varsay\u0131msal domain yenileme senaryosunda <code>yonetici@example.com<\/code> adresine gelen iletinin g\u00f6r\u00fcnen ad\u0131 sa\u011flay\u0131c\u0131y\u0131 taklit eder; ger\u00e7ek From adresi <code>yenileme@example.net<\/code> olur. Burada <code>example.net<\/code> yaln\u0131zca \u015f\u00fcpheli taraf\u0131 temsil eder. Bu alan ad\u0131n\u0131n do\u011frulanmas\u0131, kurumunuzun <code>example.com<\/code> alan\u0131yla ili\u015fkisini kan\u0131tlamaz.<\/p>\n<p><strong>SPF:<\/strong> RFC 7208&#8217;e g\u00f6re, ba\u011flant\u0131y\u0131 kuran sunucunun IP adresinin SMTP zarf g\u00f6ndereninin alan ad\u0131 ad\u0131na g\u00f6nderim yapmaya yetkili olup olmad\u0131\u011f\u0131n\u0131 denetler. Esas al\u0131nan kimlik <code>MAIL FROM<\/code> adresidir; zarf g\u00f6ndereni bo\u015fsa <code>HELO<\/code> kimli\u011fi kullan\u0131l\u0131r. SPF, posta uygulamas\u0131ndaki g\u00f6r\u00fcnen From adresini, g\u00f6nderen ad\u0131n\u0131 veya \u00f6deme talebinin do\u011frulu\u011funu denetlemez.<\/p>\n<p><strong>DKIM:<\/strong> RFC 6376&#8217;da tan\u0131mlanan imza, kapsad\u0131\u011f\u0131 g\u00f6vde ve ba\u015fl\u0131klar\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fcn do\u011frulanmas\u0131n\u0131 sa\u011flar; imzalayan alan ad\u0131 <code>d=<\/code> de\u011ferinde belirtilir. Ge\u00e7erli imza, i\u00e7eri\u011fin g\u00fcvenli oldu\u011funu s\u00f6ylemez. B\u00fct\u00fcn ba\u015fl\u0131klar\u0131n imzaland\u0131\u011f\u0131n\u0131 da varsaymay\u0131n &#8211; do\u011frulama yaln\u0131zca imzan\u0131n kapsad\u0131\u011f\u0131 veriler i\u00e7in anlam ta\u015f\u0131r.<\/p>\n<p><strong>DMARC:<\/strong> RFC 7489&#8217;a g\u00f6re g\u00f6r\u00fcnen From adresinin alan ad\u0131yla, ba\u015far\u0131l\u0131 SPF denetimindeki alan ad\u0131n\u0131n veya ba\u015far\u0131l\u0131 DKIM imzas\u0131ndaki alan ad\u0131n\u0131n hizalanmas\u0131n\u0131 de\u011ferlendirir. \u0130kisinden birinin ba\u015far\u0131yla hizalanmas\u0131 yeterlidir. Gev\u015fek hizalamada ayn\u0131 organizasyon alan ad\u0131, s\u0131k\u0131 hizalamada tam e\u015fle\u015fme aran\u0131r. DMARC politikas\u0131, ba\u015far\u0131s\u0131z iletilere uygulanmas\u0131 istenen i\u015flemi bildirir; i\u00e7eri\u011fe kefil olmaz.<\/p>\n<p>Varsay\u0131msal sald\u0131rgan kendi <code>example.net<\/code> alan\u0131nda bu kontrolleri ge\u00e7ebilir. Mesajdaki <code>https:\/\/panel.example.com.example.net\/yenileme<\/code> ba\u011flant\u0131s\u0131 yine de bilinen <code>https:\/\/panel.example.com<\/code> paneliniz de\u011fildir. Ele ge\u00e7irilmi\u015f me\u015fru <code>yenileme@example.com<\/code> hesab\u0131ndan yetkili altyap\u0131yla g\u00f6nderilen ileti de do\u011frulamadan ge\u00e7ebilir.<\/p>\n<p>Ubuntu Server 24.04 LTS \u00fczerinde BIND 9.18 ailesindeki <code>dig<\/code> i\u00e7in a\u015fa\u011f\u0131daki komutlar yaln\u0131zca DNS sorgu bi\u00e7imini g\u00f6sterir; g\u00fcvenlik yamas\u0131 d\u00fczeyi kuruluma g\u00f6re de\u011fi\u015febilir:<\/p>\n<pre><code>dig example.com TXT +noall +answer\ndig _dmarc.example.com TXT +noall +answer<\/code><\/pre>\n<p>Komutlar root gerektirmez, ileti g\u00f6ndermez, mesajdaki ba\u011flant\u0131lar\u0131 a\u00e7maz ve ekleri \u00e7al\u0131\u015ft\u0131rmaz. Yan\u0131t b\u00f6l\u00fcm\u00fcnde TXT kay\u0131tlar\u0131 varsa g\u00f6sterilir; SPF i\u00e7in <code>v=spf1<\/code>, DMARC i\u00e7in <code>v=DMARC1<\/code> ba\u015flang\u0131c\u0131 aran\u0131r. Ayr\u0131lm\u0131\u015f alan adlar\u0131n\u0131n bu kay\u0131tlar\u0131 yay\u0131mlad\u0131\u011f\u0131 varsay\u0131lmaz. Bo\u015f \u00e7\u0131kt\u0131, sorgunun durumunu g\u00f6rmeden kay\u0131t yoklu\u011fu diye yorumlanmamal\u0131d\u0131r. Bu sorgular DKIM anahtar\u0131n\u0131 istemez.<\/p>\n<p>G\u00fcncel DNS verisi ge\u00e7mi\u015f iletinin do\u011frulama sonucunu tek ba\u015f\u0131na yeniden olu\u015fturamaz. Senaryoda al\u0131c\u0131 hizmetinin <code>Authentication-Results<\/code> ba\u015fl\u0131\u011f\u0131 ekledi\u011fi varsay\u0131l\u0131r. Ger\u00e7ek incelemede bu ba\u015fl\u0131\u011f\u0131n g\u00fcvenilir al\u0131c\u0131 altyap\u0131s\u0131ndan geldi\u011fini ayr\u0131ca do\u011frulay\u0131n; g\u00f6nderenin ekledi\u011fi ayn\u0131 adl\u0131 ba\u015fl\u0131k kan\u0131t de\u011fildir.<\/p>\n<div class=\"aiw-callout aiw-callout-warn\">\n<p class=\"aiw-callout-label\">Dikkat<\/p>\n<p>Authentication-Results ba\u015fl\u0131\u011f\u0131n\u0131 yaln\u0131zca g\u00fcvenilir al\u0131c\u0131 posta altyap\u0131s\u0131n\u0131n ekledi\u011fi do\u011frulanabiliyorsa de\u011ferlendirin; iletiye \u00f6nceden eklenmi\u015f sahte bir ba\u015fl\u0131k kan\u0131t de\u011fildir. Bug\u00fcn yap\u0131lan DNS sorgusu da ge\u00e7mi\u015fte al\u0131nan bir iletinin do\u011frulama sonucunu tek ba\u015f\u0131na yeniden olu\u015fturmaz.<\/p>\n<\/div>\n<h2 id=\"supheli-iletiyi-acmadan-teknik-izleri-incelemek\">\u015e\u00fcpheli iletiyi a\u00e7madan teknik izleri incelemek<\/h2>\n<p>G\u00f6nderenin haz\u0131rlad\u0131\u011f\u0131 yenileme ekran\u0131n\u0131 g\u00f6rmeden de iletinin teknik izlerini okuyabilirsiniz. \u00d6nizlemeyi kapal\u0131 tutun. CISA, oltalama belirtileri ta\u015f\u0131yan mesajlarda ba\u011flant\u0131lara t\u0131klamaman\u0131z\u0131 ve ekleri a\u00e7maman\u0131z\u0131 \u00f6nerir. A\u00e7\u0131k\u00e7a varsay\u0131msal olan bu domain yenileme senaryosunda inceleme, HTML g\u00f6r\u00fcnt\u00fclemek yerine orijinal ileti dosyas\u0131ndaki ba\u015fl\u0131klar\u0131 ve MIME par\u00e7a t\u00fcrlerini listelemekle s\u0131n\u0131rl\u0131d\u0131r.<\/p>\n<p>Ortam Ubuntu Server 24.04 LTS ve Python 3.12 standart k\u00fct\u00fcphanesidir; g\u00fcvenlik yamas\u0131 d\u00fczeyleri kuruluma g\u00f6re de\u011fi\u015febilir. Sentetik iletinin <code>\/home\/analist\/phishing-lab\/supheli.eml<\/code> konumunda bulundu\u011fu varsay\u0131l\u0131r. Ger\u00e7ek incelemede posta istemcisinden orijinal iletiyi indirin; y\u00f6nlendirme veya kopyalama ba\u015fl\u0131klar\u0131 de\u011fi\u015ftirebilir. Dosyay\u0131 eri\u015fimi k\u0131s\u0131tl\u0131 bir dizinde koruyun. A\u015fa\u011f\u0131daki komutlar <code>\/home\/analist\/phishing-lab\/incele.py<\/code> beti\u011fini olu\u015fturur; mevcut <code>.eml<\/code> dosyas\u0131na yazmaz.<\/p>\n<pre><code>umask 077\ncat &gt; \/home\/analist\/phishing-lab\/incele.py &lt;&lt;'PY'\nfrom email import policy\nfrom email.parser import BytesParser\nfrom pathlib import Path\n\nkaynak = Path('\/home\/analist\/phishing-lab\/supheli.eml')\nwith kaynak.open('rb') as dosya:\n    ileti = BytesParser(policy=policy.default).parse(dosya)\n\nbasliklar = (\n    'From', 'To', 'Subject', 'Date', 'Message-ID',\n    'Reply-To', 'Return-Path', 'Received',\n    'Authentication-Results', 'DKIM-Signature',\n)\nfor ad in basliklar:\n    degerler = ileti.get_all(ad, [])\n    if not degerler:\n        print(f'{ad}: [yok]')\n    for deger in degerler:\n        print(f'{ad}: {ascii(str(deger))}')\n\nprint('\\nMIME parcalari:')\nfor sira, parca in enumerate(ileti.walk(), start=1):\n    print(\n        sira,\n        'tur=', ascii(parca.get_content_type()),\n        'sunum=', ascii(parca.get_content_disposition()),\n    )\n    for kusur in parca.defects:\n        print('  ayristirma_kusuru=', type(kusur).__name__)\nPY\npython3 \/home\/analist\/phishing-lab\/incele.py<\/code><\/pre>\n<p><code>BytesParser<\/code> dosyay\u0131 ikili okuma kipinde ayr\u0131\u015ft\u0131r\u0131r; <code>walk()<\/code> kapsay\u0131c\u0131lar dahil MIME par\u00e7alar\u0131n\u0131 dola\u015f\u0131r. Betik g\u00f6vdeyi yazd\u0131rmaz, ek \u00e7\u0131karmaz, ileti g\u00f6ndermez ve uzak i\u00e7erik indirmez. Root gerekmez. <code>ascii()<\/code>, ba\u015fl\u0131klardaki kontrol karakterlerini terminalde do\u011frudan i\u015fletmek yerine ka\u00e7\u0131\u015f g\u00f6sterimiyle yazd\u0131r\u0131r; T\u00fcrk\u00e7e karakterler de ka\u00e7\u0131\u015fl\u0131 g\u00f6r\u00fcn\u00fcr. <code>umask 077<\/code> yeni olu\u015fturulan beti\u011fin izinlerini k\u0131s\u0131tlar, mevcut dosyalar\u0131n izinlerini de\u011fi\u015ftirmez.<\/p>\n<p>Beklenen \u00e7\u0131kt\u0131 dosyan\u0131n yap\u0131s\u0131na ba\u011fl\u0131d\u0131r; burada \u00e7al\u0131\u015ft\u0131r\u0131lm\u0131\u015f bir test \u00e7\u0131kt\u0131s\u0131 sunulmuyor. Senaryodaki <code>From<\/code> de\u011ferinde sa\u011flay\u0131c\u0131y\u0131 taklit eden adla birlikte <code>yenileme@example.net<\/code>, <code>To<\/code> de\u011ferinde <code>yonetici@example.com<\/code> g\u00f6r\u00fcnmesi beklenir. Me\u015fru g\u00f6nderici <code>yenileme@example.com<\/code> farkl\u0131d\u0131r. Bu senaryoda <code>example.net<\/code> yaln\u0131zca \u015f\u00fcpheli taraf\u0131 temsil eder. Bulunmayan ba\u015fl\u0131klar <code>[yok]<\/code> olarak listelenir.<\/p>\n<p>MIME listesinde <code>text\/html<\/code> bulunmas\u0131 HTML&#8217;nin g\u00f6r\u00fcnt\u00fclendi\u011fi anlam\u0131na gelmez. <code>attachment<\/code> de\u011feri yaln\u0131zca bildirilen sunum bi\u00e7imidir; g\u00fcvenlik de\u011ferlendirmesi de\u011fildir. Ayr\u0131\u015ft\u0131rma kusuru g\u00f6r\u00fclmemesi de dosyay\u0131 g\u00fcvenilir yapmaz.<\/p>\n<p>Al\u0131c\u0131 hizmetin <code>Authentication-Results<\/code> ekledi\u011fi varsay\u0131l\u0131r; ger\u00e7ek incelemede ba\u015fl\u0131\u011f\u0131n g\u00fcvenilir al\u0131c\u0131 altyap\u0131s\u0131ndan geldi\u011fini ayr\u0131ca do\u011frulay\u0131n. Betik bu de\u011ferleri denetlemez, yaln\u0131zca listeler. RFC 6376&#8217;ya g\u00f6re DKIM, imzalayan alan ad\u0131yla ileti aras\u0131nda do\u011frulanabilir ili\u015fki kurar; yenileme talebinin d\u00fcr\u00fcstl\u00fc\u011f\u00fcn\u00fc garanti etmez.<\/p>\n<p>Yerel ayr\u0131\u015ft\u0131rma zarars\u0131zl\u0131k garantisi vermez: b\u00fcy\u00fck veya bozuk dosyalar kaynak t\u00fcketebilir, ayr\u0131\u015ft\u0131r\u0131c\u0131 a\u00e7\u0131klar\u0131 bulunabilir. G\u00fcncel, k\u0131s\u0131tl\u0131 yetkili bir ortam kullan\u0131n. Ger\u00e7ek iletileri herkese a\u00e7\u0131k analiz hizmetlerine y\u00fcklemeyin; ki\u015fisel bilgiler ve eri\u015fim belirte\u00e7leri i\u00e7erebilirler. Destek ekibiyle payla\u015fman\u0131z gerekiyorsa orijinali koruyun, ayr\u0131 kopyadaki hassas alanlar\u0131 maskeleyin.<\/p>\n<div class=\"aiw-callout aiw-callout-tip\">\n<p class=\"aiw-callout-label\">\u0130pucu<\/p>\n<p>Varsay\u0131msal laboratuvarda \/home\/analist\/phishing-lab\/supheli.eml dosyas\u0131 sentetiktir; ger\u00e7ek iletiler ki\u015fisel bilgiler veya eri\u015fim belirte\u00e7leri i\u00e7erebilir. Bunlar\u0131 herkese a\u00e7\u0131k analiz hizmetlerine y\u00fcklemeyin. Yerel incelemeyi ba\u011flant\u0131 a\u00e7madan, ek \u00e7\u0131karmadan ve root yetkisi kullanmadan yapmak riski azalt\u0131r; zarars\u0131zl\u0131k garantisi vermez.<\/p>\n<\/div>\n<h2 id=\"yenileme-talebini-e-postadan-bagimsiz-dogrulayin\">Yenileme talebini e-postadan ba\u011f\u0131ms\u0131z do\u011frulay\u0131n<\/h2>\n<p>Domainin ger\u00e7ekten yenilenmesi gerekiyor olabilir; bu, e-postadaki \u00f6deme ba\u011flant\u0131s\u0131n\u0131 g\u00fcvenilir yapmaz. Ayn\u0131 varsay\u0131msal senaryoda <code>yonetici@example.com<\/code> adresine gelen mesaj\u0131 i\u015flem kanal\u0131 de\u011fil, kontrol gerektiren bir uyar\u0131 olarak de\u011ferlendirin. CISA, \u015f\u00fcpheli mesajdaki ba\u011flant\u0131lar yerine kurumla ba\u011f\u0131ms\u0131z bir kanaldan ileti\u015fim kurulmas\u0131n\u0131 \u00f6nerir. Acele etmeyin. Kapanma tehdidi, do\u011frulamay\u0131 atlamak i\u00e7in gerek\u00e7e de\u011fildir.<\/p>\n<p>Yeni bir taray\u0131c\u0131 sekmesinde \u00f6nceden bildi\u011finiz <code>https:\/\/panel.example.com<\/code> adresini kendiniz yaz\u0131n veya do\u011frulanm\u0131\u015f yer iminizi kullan\u0131n. Mesajdaki <code>https:\/\/panel.example.com.example.net\/yenileme<\/code> ba\u011flant\u0131s\u0131na gitmeyin; <code>example.net<\/code> yaln\u0131zca bu varsay\u0131msal senaryoda \u015f\u00fcpheli taraf\u0131 temsil eder. Mesaja yan\u0131t vermek, i\u00e7indeki telefon numaras\u0131n\u0131 aramak veya \u00f6nerdi\u011fi destek adresine yazmak ba\u011f\u0131ms\u0131z do\u011frulama de\u011fildir. Arama reklam\u0131ndan ula\u015f\u0131lan giri\u015f sayfas\u0131 da kay\u0131tl\u0131 panel adresinizin yerini tutmaz.<\/p>\n<p>Panelde <code>example.com<\/code> kayd\u0131n\u0131 a\u00e7\u0131p domain biti\u015f tarihini ve yenileme d\u00f6nemini inceleyin. \u0130lgili faturan\u0131n alan ad\u0131n\u0131, tutar\u0131n\u0131, son \u00f6deme tarihini ve \u00f6deme durumunu e-postadaki iddialarla kar\u015f\u0131la\u015ft\u0131r\u0131n. Ard\u0131ndan otomatik yenilemenin etkinli\u011fine, kay\u0131tl\u0131 \u00f6deme y\u00f6nteminin ge\u00e7erlili\u011fine ve ba\u015far\u0131s\u0131z tahsilat bildirimlerine bak\u0131n. Otomatik yenilemenin a\u00e7\u0131k olmas\u0131, \u00f6demenin al\u0131nd\u0131\u011f\u0131n\u0131 g\u00f6stermez; fatura vadesiyle domain biti\u015f tarihi de ayn\u0131 olmak zorunda de\u011fildir.<\/p>\n<p>Hesap bildirimlerinde ayn\u0131 talebin bulunup bulunmad\u0131\u011f\u0131n\u0131 kontrol edin. Bildirim yoksa bunu tek ba\u015f\u0131na sahtecilik kan\u0131t\u0131 saymay\u0131n. Panel ile mesaj \u00e7eli\u015fiyorsa panel \u00fczerinden destek talebi a\u00e7\u0131n veya \u00f6nceden kaydetti\u011finiz destek kanal\u0131n\u0131 kullan\u0131n. Alan ad\u0131, vade ve fatura e\u015fle\u015fmesini do\u011frulat\u0131n. Beklenen me\u015fru adres <code>yenileme@example.com<\/code> iken ger\u00e7ek From adresinin <code>yenileme@example.net<\/code> oldu\u011funu bildirebilirsiniz; parola, tek kullan\u0131ml\u0131k kod veya kart bilgisi payla\u015fmay\u0131n.<\/p>\n<p><strong>Ger\u00e7ek yenileme ihtiyac\u0131, sahte \u00f6deme ba\u011flant\u0131s\u0131n\u0131 me\u015frula\u015ft\u0131rmaz.<\/strong> Tarihin veya tutar\u0131n do\u011fru \u00e7\u0131kmas\u0131 da ba\u011flant\u0131n\u0131n kuruma ait oldu\u011funu kan\u0131tlamaz. Yenileme gerekiyorsa e-postaya d\u00f6nmeden bilinen panelin fatura ak\u0131\u015f\u0131n\u0131 izleyin.<\/p>\n<p>Parola y\u00f6neticisinin alan ad\u0131 e\u015fle\u015ftirmesi ek bir uyar\u0131 katman\u0131 sa\u011flar. Bekledi\u011finiz otomatik doldurma ger\u00e7ekle\u015fmiyorsa parolay\u0131 elle yap\u0131\u015ft\u0131rmadan adresi kontrol edin. E\u015fle\u015ftirme kurallar\u0131 \u00fcr\u00fcne ve ayarlara ba\u011fl\u0131d\u0131r; doldurman\u0131n \u00e7al\u0131\u015fmas\u0131 ya da \u00e7al\u0131\u015fmamas\u0131 tek ba\u015f\u0131na g\u00fcvenlik h\u00fckm\u00fc vermez.<\/p>\n<p><a href=\"https:\/\/www.vps.tc\/blog\/tr\/passkey-nedir-sifresiz-giris-nasil-calisir\/\">Passkey<\/a>, panel destekliyorsa hizmetin alan ad\u0131na ba\u011fl\u0131 kimlik do\u011frulamas\u0131yla oltalamaya dayan\u0131kl\u0131 giri\u015f sa\u011flar. Ancak \u00f6deme talebinin do\u011frulu\u011funu onaylamaz; a\u00e7\u0131k oturumun \u00e7al\u0131nmas\u0131n\u0131 veya zay\u0131f hesap kurtarma yollar\u0131n\u0131 tek ba\u015f\u0131na engellemez. Alternatif giri\u015f y\u00f6ntemlerini de koruyun. \u00d6demeden sonra ayn\u0131 panelde tahsilat kayd\u0131n\u0131 ve yenileme tamamland\u0131\u011f\u0131nda g\u00fcncellenen biti\u015f tarihini kontrol edin.<\/p>\n<h2 id=\"tikladiysaniz-sonraki-adim-yapilan-isleme-bagli\">T\u0131klad\u0131ysan\u0131z sonraki ad\u0131m yap\u0131lan i\u015fleme ba\u011fl\u0131<\/h2>\n<p>Varsay\u0131msal domain yenileme senaryosunda <code>yonetici@example.com<\/code> al\u0131c\u0131s\u0131n\u0131n ba\u011flant\u0131y\u0131 a\u00e7mas\u0131yla \u00f6deme yapmas\u0131 ayn\u0131 m\u00fcdahaleyi gerektirmez. \u00d6nce durun. Hangi i\u015flemleri yapt\u0131\u011f\u0131n\u0131z\u0131 belirleyin; birden fazla ad\u0131m att\u0131ysan\u0131z ilgili m\u00fcdahaleleri birlikte uygulay\u0131n. Parola de\u011fi\u015fikli\u011fi, uygulama izinlerini veya \u00f6demeyi kendili\u011finden geri almaz.<\/p>\n<p><strong>Yaln\u0131zca ba\u011flant\u0131y\u0131 a\u00e7t\u0131ysan\u0131z:<\/strong> <code>https:\/\/panel.example.com.example.net\/yenileme<\/code> sayfas\u0131n\u0131 kapat\u0131n; kontrol amac\u0131yla yeniden ziyaret etmeyin. T\u0131klamak tek ba\u015f\u0131na hesab\u0131n ele ge\u00e7irildi\u011fini kan\u0131tlamaz. Taray\u0131c\u0131n\u0131n indirme ge\u00e7mi\u015fini ve siteye verdi\u011finiz izinleri inceleyin. \u0130nen dosyalar\u0131 a\u00e7may\u0131n; taray\u0131c\u0131 ve i\u015fletim sistemi g\u00fcncellemelerini do\u011frulay\u0131n. Bilgi girmediyseniz bile beklenmeyen oturum bildirimlerini izleyin; bildirimin i\u00e7indeki ba\u011flant\u0131 yerine hesab\u0131 bilinen adresinden kontrol edin.<\/p>\n<p><strong>Parola girdiyseniz:<\/strong> G\u00fcvenilir bir cihazdan bilinen panel adresine giderek parolay\u0131 de\u011fi\u015ftirin. Ayn\u0131 parolay\u0131 kulland\u0131\u011f\u0131n\u0131z di\u011fer hesaplara da farkl\u0131 parolalar atay\u0131n; \u00f6zellikle kurtarma iletilerinin ula\u015ft\u0131\u011f\u0131 posta hesab\u0131n\u0131 koruyun. T\u00fcm oturumlar\u0131 sonland\u0131r\u0131n, kurtarma adreslerini ve MFA y\u00f6ntemlerini denetleyin. Yaln\u0131zca mevcut taray\u0131c\u0131dan \u00e7\u0131k\u0131\u015f yapmak yeterli de\u011fildir.<\/p>\n<p><strong>MFA iste\u011fini onaylad\u0131ysan\u0131z:<\/strong> Onay, sald\u0131rgan\u0131n giri\u015fini tamamlam\u0131\u015f olabilir. G\u00fcvenilir cihazdan parolay\u0131 de\u011fi\u015ftirin, t\u00fcm oturumlar\u0131 sonland\u0131r\u0131n ve hizmetin destekledi\u011fi eri\u015fim belirte\u00e7lerini iptal edin. Tan\u0131mad\u0131\u011f\u0131n\u0131z do\u011frulama y\u00f6ntemlerini kald\u0131r\u0131n. Eri\u015femiyorsan\u0131z sa\u011flay\u0131c\u0131dan hesab\u0131n ge\u00e7ici olarak kilitlenmesini isteyin; yeni do\u011frulama isteklerini reddedin.<\/p>\n<p><strong>OAuth izni verdiyseniz:<\/strong> G\u00fcvenilir cihazdan hesab\u0131n ba\u011fl\u0131 uygulamalar b\u00f6l\u00fcm\u00fcne ula\u015farak \u015f\u00fcpheli uygulaman\u0131n yetkilendirmesini iptal edin. Parola de\u011fi\u015ftirmek bu izni mutlaka kald\u0131rmaz. Uygulaman\u0131n hangi verilere eri\u015febildi\u011fini kaydedin; yetkiyi kald\u0131rmak, daha \u00f6nce kopyalanm\u0131\u015f verileri geri getirmez.<\/p>\n<p>Parola, MFA veya OAuth \u00fczerinden hesap eri\u015fimi s\u00f6z konusuysa posta y\u00f6nlendirmelerini, gelen kutusu kurallar\u0131n\u0131 ve g\u00f6nderilmi\u015f iletileri inceleyin. Panelde DNS de\u011fi\u015fikliklerini, alan ad\u0131 transferlerini, ileti\u015fim bilgilerini ve yeni API anahtarlar\u0131n\u0131 denetleyin. Tan\u0131mad\u0131\u011f\u0131n\u0131z i\u015flemleri zamanlar\u0131yla kaydedip sa\u011flay\u0131c\u0131ya iletin.<\/p>\n<p><strong>\u00d6deme yapt\u0131ysan\u0131z veya kart bilgisi girdiyseniz:<\/strong> Bankan\u0131zla ya da \u00f6deme kurulu\u015fuyla bilinen uygulamas\u0131 veya telefon numaras\u0131 \u00fczerinden hemen ileti\u015fime ge\u00e7in. Tutar\u0131, zaman\u0131 ve i\u015flem referans\u0131n\u0131 bildirin; kart\u0131n korunmas\u0131n\u0131 ve itiraz se\u00e7eneklerini sorun. \u0130ade garantisi yoktur.<\/p>\n<p><strong>Dosya \u00e7al\u0131\u015ft\u0131rd\u0131ysan\u0131z:<\/strong> Cihaz\u0131 a\u011fdan ay\u0131r\u0131p teknik destek al\u0131n. Hesap kurtarma i\u015flemlerini ba\u015fka, g\u00fcvenilir bir cihazdan y\u00fcr\u00fct\u00fcn. Dosya ad\u0131n\u0131 ve \u00e7al\u0131\u015ft\u0131rma saatini kaydedin; izleri silebilecek geli\u015fig\u00fczel temizlikten ka\u00e7\u0131n\u0131n.<\/p>\n<p>CISA, oltalama \u015f\u00fcphesini bildirmenizi \u00f6nerir. Orijinal iletiyi ba\u015fl\u0131klar\u0131yla, i\u015flem zaman\u0131n\u0131 ve saat dilimini saklayarak sa\u011flay\u0131c\u0131n\u0131n bilinen destek kanal\u0131na ba\u015fvurun; parola veya do\u011frulama kodu payla\u015fmay\u0131n. Sentetik iletiyi <code>\/home\/analist\/phishing-lab\/supheli.eml<\/code> yolunda koruyun. Sonraki yenilemede kullanmak i\u00e7in bilinen <code>https:\/\/panel.example.com<\/code> adresini taray\u0131c\u0131n\u0131z\u0131n yer imlerine ekleyin.<\/p>\n<h2 id=\"yenileme-odemesinden-once-kontrol-edin\">Yenileme \u00d6demesinden \u00d6nce Kontrol Edin<\/h2>\n<ul class=\"aiw-checklist\">\n<li>Aciliyet iddias\u0131yla i\u015flem yapmay\u0131 durdurun; e-postadaki ba\u011flant\u0131lar\u0131 ve ekleri a\u00e7may\u0131n.<\/li>\n<li>G\u00f6r\u00fcnen g\u00f6nderen ad\u0131ndan ayr\u0131 olarak From, Reply-To ve Return-Path adreslerini inceleyin.<\/li>\n<li>Ba\u011flant\u0131y\u0131 ziyaret etmeden hostname b\u00f6l\u00fcm\u00fcn\u00fc ay\u0131r\u0131n ve bekledi\u011finiz alan ad\u0131yla kar\u015f\u0131la\u015ft\u0131r\u0131n.<\/li>\n<li>Posta do\u011frulama sonu\u00e7lar\u0131n\u0131 yaln\u0131zca g\u00fcvenilir al\u0131c\u0131 altyap\u0131s\u0131n\u0131n ekledi\u011fi ba\u015fl\u0131klardan de\u011ferlendirin.<\/li>\n<li>\u00d6nceden bildi\u011finiz m\u00fc\u015fteri panelinde domain biti\u015f tarihini, faturay\u0131, otomatik yenilemeyi ve hesap bildirimlerini kar\u015f\u0131la\u015ft\u0131r\u0131n.<\/li>\n<li>Orijinal iletiyi ve al\u0131nma zaman\u0131n\u0131 koruyarak sa\u011flay\u0131c\u0131n\u0131n kay\u0131tl\u0131 destek kanal\u0131na bildirin.<\/li>\n<li>Yapt\u0131\u011f\u0131n\u0131z i\u015fleme uygun g\u00fcvenlik m\u00fcdahalesini uygulay\u0131n ve do\u011frulad\u0131\u011f\u0131n\u0131z panel adresini yer imlerine ekleyin.<\/li>\n<\/ul>\n<div class=\"aiw-cta\">\n<p>Domain biti\u015f tarihini ve a\u00e7\u0131k faturalar\u0131, e-postadaki ba\u011flant\u0131 yerine \u00f6nceden bildi\u011finiz m\u00fc\u015fteri panelinden kontrol edin. Do\u011frulad\u0131\u011f\u0131n\u0131z panel adresini \u015fimdi yer imlerine ekleyin.<\/p>\n<p class=\"aiw-cta-action\"><a href=\"https:\/\/www.vps.tc\/tr\/vps\">VPS paketlerini inceleyin<\/a><\/p>\n<\/div>\n<h2 id=\"sik-sorulan-sorular\">S\u0131k Sorulan Sorular<\/h2>\n<div class=\"aiw-faq\">\n<details class=\"aiw-faq-item\" open>\n<summary>Oltalama nedir, spam e-postadan fark\u0131 ne?<\/summary>\n<p>Oltalama, g\u00fcvenilir bir ki\u015fi veya kurulu\u015fu taklit ederek bilgi, \u00f6deme ya da eri\u015fim elde etmeye \u00e7al\u0131\u015fan sald\u0131r\u0131d\u0131r. Spam ise genellikle istenmeyen toplu mesajlar\u0131 ifade eder; her spam ileti oltalama de\u011fildir. Varsay\u0131msal domain yenileme mesaj\u0131nda belirleyici risk, hesap kapatma tehdidinin sizi sahte \u00f6deme veya giri\u015f sayfas\u0131na y\u00f6nlendirmesidir.<\/p>\n<\/details>\n<details class=\"aiw-faq-item\">\n<summary>G\u00f6nderen ad\u0131 do\u011fruysa domain yenileme e-postas\u0131na g\u00fcvenebilir miyim?<\/summary>\n<p>Hay\u0131r. G\u00f6r\u00fcnen g\u00f6nderen ad\u0131 kolayca taklit edilebilir; ger\u00e7ek From adresini ayr\u0131ca incelemeniz gerekir. Varsay\u0131msal senaryoda sa\u011flay\u0131c\u0131n\u0131n ad\u0131 g\u00f6r\u00fcnse de adres yenileme@example.net olur. Reply-To ve Return-Path farkl\u0131l\u0131klar\u0131 ek ipu\u00e7lar\u0131d\u0131r, ancak me\u015fru g\u00f6nderim hizmetlerinde de g\u00f6r\u00fclebilir. D\u00fczg\u00fcn T\u00fcrk\u00e7e ve tan\u0131d\u0131k logo yerine talebi bildi\u011finiz panelden do\u011frulay\u0131n.<\/p>\n<\/details>\n<details class=\"aiw-faq-item\">\n<summary>HTTPS kullanan bir ba\u011flant\u0131 da oltalama olabilir mi?<\/summary>\n<p>Evet. HTTPS, ba\u011flant\u0131n\u0131n \u015fifrelenmesini ve sertifika do\u011frulamas\u0131yla ba\u011fland\u0131\u011f\u0131n\u0131z alan ad\u0131n\u0131n denetlenmesini sa\u011flar; site sahibinin d\u00fcr\u00fcstl\u00fc\u011f\u00fcn\u00fc kan\u0131tlamaz. Varsay\u0131msal https:\/\/panel.example.com.example.net\/yenileme ba\u011flant\u0131s\u0131 example.net alan ad\u0131na ba\u011fl\u0131d\u0131r. Adreste example.com ifadesinin ge\u00e7mesi yeterli de\u011fildir. Ayr\u0131ca ger\u00e7ek adreslerde kay\u0131tl\u0131 alan ad\u0131n\u0131 her zaman son iki noktaya ayr\u0131lm\u0131\u015f par\u00e7adan belirleyemezsiniz; alan ad\u0131 uzant\u0131lar\u0131n\u0131n yap\u0131s\u0131 de\u011fi\u015febilir.<\/p>\n<\/details>\n<details class=\"aiw-faq-item\">\n<summary>SPF, DKIM ve DMARC ba\u015far\u0131l\u0131ysa e-posta g\u00fcvenli midir?<\/summary>\n<p>Hay\u0131r. SPF, zarf g\u00f6ndereninin alan ad\u0131 i\u00e7in g\u00f6nderim yetkisini; DKIM, imzalanan i\u00e7eri\u011fin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve imzalayan alan ad\u0131n\u0131 denetler. DMARC, ba\u015far\u0131l\u0131 SPF veya DKIM sonucunun g\u00f6r\u00fcnen From alan ad\u0131yla hizalanmas\u0131n\u0131 de\u011ferlendirir. Sald\u0131rgan kendi alan ad\u0131nda bu kontrolleri ge\u00e7ebilir. Ele ge\u00e7irilmi\u015f me\u015fru bir hesaptan g\u00f6nderilen zararl\u0131 ileti de do\u011frulamadan ge\u00e7ebilir.<\/p>\n<\/details>\n<details class=\"aiw-faq-item\">\n<summary>\u015e\u00fcpheli e-postay\u0131 a\u00e7madan nas\u0131l inceleyebilirim?<\/summary>\n<p>\u0130letiyi HTML olarak g\u00f6r\u00fcnt\u00fclemeden orijinal .eml dosyas\u0131n\u0131 yerelde ayr\u0131\u015ft\u0131rabilirsiniz. Varsay\u0131msal laboratuvarda Ubuntu Server 24.04 LTS ve Python 3.12 email.parser.BytesParser ile ba\u015fl\u0131klar ve MIME par\u00e7a t\u00fcrleri incelenir; urllib.parse ile ba\u011flant\u0131n\u0131n bile\u015fenleri a\u011f ba\u011flant\u0131s\u0131 kurulmadan ayr\u0131l\u0131r. Ekleri \u00e7al\u0131\u015ft\u0131rmay\u0131n, uzak i\u00e7erikleri y\u00fcklemeyin. Ger\u00e7ek iletileri ki\u015fisel veri i\u00e7erebilecekleri i\u00e7in herkese a\u00e7\u0131k hizmetlere y\u00fcklemeyin.<\/p>\n<\/details>\n<details class=\"aiw-faq-item\">\n<summary>Oltalama ba\u011flant\u0131s\u0131na t\u0131klad\u0131m, ne yapmal\u0131y\u0131m?<\/summary>\n<p>Yaln\u0131zca a\u00e7t\u0131ysan\u0131z sayfay\u0131 kapat\u0131n; indirmeleri ve verdi\u011finiz izinleri kontrol edin. Parola girdiyseniz g\u00fcvenilir cihazdan de\u011fi\u015ftirin, oturumlar\u0131 kapat\u0131n. MFA onaylad\u0131ysan\u0131z oturumlar\u0131 ve hesap hareketlerini denetleyin; OAuth izni verdiyseniz uygulama yetkisini iptal edin. Posta y\u00f6nlendirmelerini ve panel i\u015flemlerini inceleyin. \u00d6deme yapt\u0131ysan\u0131z bankaya bildirin. Dosya \u00e7al\u0131\u015ft\u0131rd\u0131ysan\u0131z cihaz\u0131 a\u011fdan ay\u0131r\u0131p teknik destek al\u0131n. Orijinal iletiyi ve zaman\u0131 saklay\u0131n.<\/p>\n<\/details>\n<\/div>\n<h2 id=\"kaynaklar\">Kaynaklar<\/h2>\n<ul class=\"aiw-sources\">\n<li><a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" target=\"_blank\" rel=\"noopener\">CISA &#8211; Oltalama Mesajlar\u0131n\u0131 Tan\u0131ma ve Bildirme<\/a> \u2014 cisa.gov<\/li>\n<li><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc7208\" target=\"_blank\" rel=\"noopener\">RFC 7208 &#8211; SPF ile E-posta G\u00f6nderim Yetkisi Denetimi<\/a> \u2014 rfc-editor.org<\/li>\n<li><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc6376\" target=\"_blank\" rel=\"noopener\">RFC 6376 &#8211; DKIM E-posta \u0130mzalar\u0131<\/a> \u2014 rfc-editor.org<\/li>\n<li><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc7489\" target=\"_blank\" rel=\"noopener\">RFC 7489 &#8211; DMARC Alan Ad\u0131 Hizalamas\u0131 ve Politikalar\u0131<\/a> \u2014 rfc-editor.org<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Domaininizin kapanaca\u011f\u0131n\u0131 s\u00f6yleyen bir e-posta, ger\u00e7ek bir yenileme bildirimi olmayabilir. G\u00f6nderen adresini, ba\u011flant\u0131n\u0131n alan ad\u0131n\u0131 ve posta do\u011frulama sonu\u00e7lar\u0131n\u0131 birlikte de\u011ferlendirin; \u00f6deme talebini bildi\u011finiz m\u00fc\u015fteri panelinden do\u011frulay\u0131n.<\/p>\n","protected":false},"author":2,"featured_media":1098,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[],"class_list":["post-1100","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-genel"],"lang":"tr","translations":{"tr":1100,"en":1101},"pll_sync_post":[],"_links":{"self":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts\/1100","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/comments?post=1100"}],"version-history":[{"count":1,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts\/1100\/revisions"}],"predecessor-version":[{"id":1102,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts\/1100\/revisions\/1102"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/media\/1098"}],"wp:attachment":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/media?parent=1100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/categories?post=1100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/tags?post=1100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}