id: chime-phish

info:
  name: Chime phishing Detection
  author: rxerium
  severity: info
  description: |
    A Chime phishing website was detected
  reference:
    - https://chime.com
  metadata:
    max-request: 1
  tags: phishing,chime,fintech,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Chime'
          - 'No monthly fees. 60k+ ATMs. Build credit. Get fee-free overdraft up to $200.'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"chime.com")'
# digest: 490a0046304402201db1c424996c7ab616354ad599efe44349e555bde420ef661a89987e141fa913022011c15c172ec1c754aa5bc64b23742587f7ebfa13de9290f59784f2c1a2138f6e:922c64590222798bb761d5b6d8e72950