id: citibank-phish

info:
  name: Citibank phishing Detection
  author: rxerium
  severity: info
  description: |
    A Citibank phishing website was detected
  reference:
    - https://citi.com
  metadata:
    max-request: 1
  tags: phishing,citibank,citi,bank,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Citi'
          - 'Citibank is the consumer division of financial services multinational Citigroup. Citibank was founded in 1812 as the City Bank of New York, and later became First National City Bank of New York. Citibank provides credit cards, mortgages, personal loans, commercial loans, and lines of credit.'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"citi.com")'
          - '!contains(host,"citibank.com")'
# digest: 4a0a00473045022100cb181ee91fa91a21c1aba3af67532983362ca2a996fafdda5cdbe7723ed876d80220329801f9bdd0d84898a91be50bccb7217930d4bbe8f5bd67fa4c45ec93a0250a:922c64590222798bb761d5b6d8e72950