{"id":125,"date":"2025-04-08T13:56:28","date_gmt":"2025-04-08T10:56:28","guid":{"rendered":"https:\/\/eclitgo.eclit.com\/blog\/?p=125"},"modified":"2025-04-08T16:25:10","modified_gmt":"2025-04-08T13:25:10","slug":"gelen-kutusunda-gizlenen-tehlike-phishing-saldirilari","status":"publish","type":"post","link":"https:\/\/eclitgo.eclit.com\/blog\/gelen-kutusunda-gizlenen-tehlike-phishing-saldirilari\/","title":{"rendered":"Gelen Kutusunda Gizlenen Tehlike: Phishing Sald\u0131r\u0131lar\u0131\u00a0"},"content":{"rendered":"\n
\n
\"phishing
<\/figcaption><\/figure>\n<\/figure>\n\n\n\n

Her g\u00fcn milyonlarca kullan\u0131c\u0131, ger\u00e7ek bir banka, kargo firmas\u0131 ya da teknoloji \u015firketinden geliyormu\u015f gibi g\u00f6r\u00fcnen sahte e-postalara t\u0131kl\u0131yor. Bu sahte mesajlar yaln\u0131zca bireyleri de\u011fil, kurumsal yap\u0131lar\u0131 da hedef alarak b\u00fcy\u00fck veri ihlallerine yol a\u00e7abiliyor. Peki bu sald\u0131r\u0131lar nas\u0131l ger\u00e7ekle\u015fiyor, nas\u0131l fark edilir ve daha da \u00f6nemlisi nas\u0131l \u00f6nlenir? <\/p>\n\n\n\n

Phishing Nedir?<\/strong> <\/h2>\n\n\n\n

Phishing (oltalama), siber sald\u0131rganlar\u0131n kullan\u0131c\u0131lar\u0131 kand\u0131rarak \u015fifre, kredi kart\u0131 bilgisi veya kurumsal hesap eri\u015fimi gibi kritik verileri ele ge\u00e7irmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131 bir sosyal m\u00fchendislik y\u00f6ntemidir. Bu sald\u0131r\u0131lar genellikle e-posta, SMS, sahte web siteleri ya da hatta do\u011frudan telefon aramalar\u0131 yoluyla ger\u00e7ekle\u015ftirilir. Ama\u00e7 kullan\u0131c\u0131y\u0131 ikna ederek kendi elleriyle bilgilerini payla\u015fmas\u0131n\u0131 sa\u011flamakt\u0131r. <\/p>\n\n\n\n

Phishing T\u00fcrleri ve \u00d6rnekleri<\/strong> <\/h2>\n\n\n\n

Phishing sald\u0131r\u0131lar\u0131 \u00e7e\u015fitli \u015fekillerde kar\u015f\u0131m\u0131za \u00e7\u0131kabilir. Bunlar\u0131n baz\u0131lar\u0131 g\u00fcvenir bir kurumdan gelen bir e-posta gibi haz\u0131rlan\u0131r, baz\u0131lar\u0131 ise sizi hemen harekete ge\u00e7irme g\u00f6revini \u00fcstlenir. Oltalama t\u00fcrleri \u015f\u00f6yle s\u0131ralanabilir: <\/p>\n\n\n\n

E-posta Phishing<\/strong><\/h2>\n\n\n\n

Sald\u0131rgan, g\u00fcvenilir bir kurum gibi g\u00f6r\u00fcnerek kullan\u0131c\u0131ya e-posta g\u00f6nderir. 
\u00d6rnek: \u201cBankan\u0131zdan gelen\u201d bir e-postada \u201cHesab\u0131n\u0131z ask\u0131ya al\u0131nd\u0131, buradan giri\u015f yap\u0131n\u201d ifadesiyle sahte bir giri\u015f sayfas\u0131na y\u00f6nlendirilirsiniz.<\/p>\n\n\n\n

Spear Phishing<\/strong><\/h2>\n\n\n\n

Hedefi belirgin sald\u0131r\u0131lard\u0131r. Sald\u0131rgan, kurban\u0131n ad\u0131, pozisyonu, \u00e7al\u0131\u015ft\u0131\u011f\u0131 firma gibi bilgileri kullanarak ki\u015fiye \u00f6zel mesaj olu\u015fturur. \u00d6rnek: Muhasebe \u00e7al\u0131\u015fan\u0131na, y\u00f6neticisi gibi davranarak \u00f6deme talimat\u0131 i\u00e7eren bir belge g\u00f6nderilir.<\/p>\n\n\n\n

Smishing ve Vishing<\/strong><\/h2>\n\n\n\n

SMS yoluyla link g\u00f6nderilir (smishing) ya da do\u011frudan telefonla aranarak bilgi istenir (vishing). \u00d6rnek: \u201cKargonuz teslim edilemedi, takip etmek i\u00e7in buraya t\u0131klay\u0131n.\u201d gibi mesajlar s\u0131kl\u0131kla kullan\u0131l\u0131r.<\/p>\n\n\n\n

Clone Phishing<\/strong><\/h2>\n\n\n\n

Daha \u00f6nce g\u00f6nderilmi\u015f ger\u00e7ek bir e-posta kopyalan\u0131r, i\u00e7eri\u011findeki linkler zararl\u0131 hale getirilir ve yeniden g\u00f6nderilir.<\/p>\n\n\n\n

Phishing Sald\u0131r\u0131lar\u0131 Nas\u0131l Anla\u015f\u0131l\u0131r?<\/strong> <\/h2>\n\n\n\n

Geli\u015fmi\u015f oltalama kampanyalar\u0131 olduk\u00e7a ikna edici olabilir. Ancak a\u015fa\u011f\u0131daki teknik i\u015faretlere dikkat ederek \u015f\u00fcpheli durumlar\u0131 fark edebilirsiniz: <\/p>\n\n\n\n

    \n
  • Alan ad\u0131 benzerlikleri:<\/strong> \u00d6rne\u011fin amaz0n.com veya secure-paypal-login.net gibi sahte domain\u2019ler. <\/li>\n<\/ul>\n\n\n\n
      \n
    • SSL kullan\u0131m\u0131 eksikli\u011fi:<\/strong> Ger\u00e7ek siteler \u00e7o\u011funlukla HTTPS ile korunur. Ancak sald\u0131rganlar da art\u0131k SSL kullanabildi\u011fi i\u00e7in sadece kilit simgesi yeterli de\u011fildir. Alan ad\u0131 mutlaka kontrol edilmelidir. <\/li>\n<\/ul>\n\n\n\n
        \n
      • Header analizi:<\/strong> Kurumsal mail sistemlerinde gelen e-postan\u0131n “Received” ve “Return-Path” bilgileri incelenerek sahte kaynaklar tespit edilebilir. <\/li>\n<\/ul>\n\n\n\n
          \n
        • E-posta kimlik do\u011frulama eksikli\u011fi:<\/strong> SPF, DKIM ve DMARC kay\u0131tlar\u0131 olmayan alan adlar\u0131ndan gelen e-postalar g\u00fcvenilir olmayabilir. <\/li>\n<\/ul>\n\n\n\n
            \n
          • Dil bilgisi hatalar\u0131 ve aciliyet vurgusu:<\/strong> \u201cHemen t\u0131klay\u0131n!\u201d, \u201cSon uyar\u0131!\u201d, \u201cHesab\u0131n\u0131z ask\u0131ya al\u0131nacak!\u201d gibi panik olu\u015fturan c\u00fcmleler. <\/li>\n<\/ul>\n\n\n\n

            Phishing’ten Nas\u0131l Korunulur?<\/strong><\/h2>\n\n\n\n

            Phishing sald\u0131r\u0131lar\u0131ndan korunmak i\u00e7in yaln\u0131zca teknik \u00f6nlemler yetmez, kullan\u0131c\u0131lar\u0131n da g\u00fcvenlik bilinci kazanmas\u0131 gerekir.  <\/p>\n\n\n\n

            Bireysel \u00d6nlemler:<\/strong> <\/h3>\n\n\n\n
              \n
            • Asla do\u011frudan e-postadan gelen linke t\u0131klamay\u0131n; adresi manuel yaz\u0131n. <\/li>\n<\/ul>\n\n\n\n
                \n
              • Tan\u0131mad\u0131\u011f\u0131n\u0131z ki\u015filerden gelen eklere t\u0131klamay\u0131n. <\/li>\n<\/ul>\n\n\n\n
                  \n
                • \u015e\u00fcpheli durumlarda kurumu do\u011frudan arayarak do\u011frulama yap\u0131n. <\/li>\n<\/ul>\n\n\n\n
                    \n
                  • Parolalar\u0131n\u0131z\u0131 payla\u015fmay\u0131n, \u00e7ok fakt\u00f6rl\u00fc kimlik do\u011frulama (MFA) kullan\u0131n. <\/li>\n<\/ul>\n\n\n\n

                    Kurumsal \u00d6nlemler:<\/strong> <\/h3>\n\n\n\n
                      \n
                    • SPF, DKIM ve DMARC politikalar\u0131 etkinle\u015ftirilmelidir. <\/li>\n<\/ul>\n\n\n\n
                        \n
                      • G\u00fc\u00e7l\u00fc e-posta g\u00fcvenlik \u00e7\u00f6z\u00fcmleri kullan\u0131lmal\u0131d\u0131r (\u00f6rne\u011fin sandbox ortam\u0131nda eklenti testleri). <\/li>\n<\/ul>\n\n\n\n
                          \n
                        • Kullan\u0131c\u0131lara d\u00fczenli oltalama sim\u00fclasyonlar\u0131 ve fark\u0131ndal\u0131k e\u011fitimleri verilmelidir. <\/li>\n<\/ul>\n\n\n\n
                            \n
                          • Eri\u015fim kontrolleri ve oturum y\u00f6netimi iyile\u015ftirilmelidir. <\/li>\n<\/ul>\n\n\n\n

                            \u00d6rnek Bir Vaka<\/strong> <\/h3>\n\n\n\n

                            Gelen phishing mail:<\/strong> <\/mark><\/p>\n\n\n\n

                            (Please kindly forward this to your CEO, because this is urgent. If you believe this has been sent to you in error, please ignore it. Thanks) <\/p>\n\n\n\n

                            Dear CEO, <\/p>\n\n\n\n

                            We are the domain name registration service company in China. We received an application from Hongfei Ltd on April 1, 2025. They want to request “xx” as their internet keyword and China (CN) domain names (xx.cn, xx.com.cn, xx.net.cn, xx.org.cn). But after checking it, we find this name conflict with your company name or trademark. In order to deal with this matter better, it’s necessary to send email to you and confirm whether this company is your distributor or business partner in China?<\/p>\n\n\n\n

                             Bu mailin phishing oldu\u011funu nas\u0131l tespit ettik?<\/strong> <\/p>\n\n\n\n

                              \n
                            1. \u00c7in merkezli bir alan ad\u0131, bu tarz alan adlar\u0131 (org.cn) genellikle g\u00fcvenilmez. Org alan adlar\u0131 sivil toplum kurulu\u015flar\u0131 taraf\u0131ndan kullan\u0131l\u0131r. Kurumsal bir alan ad\u0131 de\u011fildir. <\/li>\n<\/ol>\n\n\n\n
                                \n
                              1. Bu alan ad\u0131 ger\u00e7ek bir domain kay\u0131t firmas\u0131 m\u0131? Belirsiz. Who is kayd\u0131nda bilgi bulunmuyor. Pishing sald\u0131r\u0131lar\u0131nda sahte alan adlar\u0131 kullan\u0131l\u0131r. <\/li>\n<\/ol>\n\n\n\n
                                  \n
                                1. “L\u00fctfen bu e-postay\u0131 CEO’nuza iletin” gibi ifadeler genelde aciliyet hissi yaratmak i\u00e7in kullan\u0131l\u0131r. Bu, klasik bir sosyal m\u00fchendislik takti\u011fidir. <\/li>\n<\/ol>\n\n\n\n
                                    \n
                                  1. \u201cBir firma sizin alan ad\u0131n\u0131z\u0131 almak istiyor\u201d i\u00e7eri\u011fi, phishing sald\u0131r\u0131lar\u0131nda \u00e7ok s\u0131k rastlanan bir taktiktir. <\/li>\n<\/ol>\n\n\n\n

                                    Phishing sald\u0131r\u0131lar\u0131 geli\u015ftik\u00e7e siber g\u00fcvenlik \u00f6nlemleri de s\u0131kla\u015f\u0131yor. Bu noktada \u00f6nem kazanan \u201cteknolojik korumay\u0131 do\u011fru kullan\u0131c\u0131 davran\u0131\u015f\u0131yla birle\u015ftirme\u201d oluyor. <\/p>\n","protected":false},"excerpt":{"rendered":"

                                    Her g\u00fcn milyonlarca kullan\u0131c\u0131, ger\u00e7ek bir banka, kargo firmas\u0131 ya da teknoloji \u015firketinden geliyormu\u015f gibi g\u00f6r\u00fcnen sahte e-postalara t\u0131kl\u0131yor. Bu sahte mesajlar yaln\u0131zca bireyleri de\u011fil, kurumsal yap\u0131lar\u0131 da hedef alarak…<\/p>\n","protected":false},"author":1,"featured_media":132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-125","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-genel"},"_links":{"self":[{"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/posts\/125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/comments?post=125"}],"version-history":[{"count":4,"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/posts\/125\/revisions"}],"predecessor-version":[{"id":133,"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/posts\/125\/revisions\/133"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/media\/132"}],"wp:attachment":[{"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/media?parent=125"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/categories?post=125"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eclitgo.eclit.com\/blog\/wp-json\/wp\/v2\/tags?post=125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}