id: coinbase-phish

info:
  name: Coinbase phishing Detection
  author: rxerium
  severity: info
  description: |
    A Coinbase phishing website was detected
  reference:
    - https://coinbase.com
  metadata:
    max-request: 1
  tags: phishing,coinbase,crypto,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Coinbase - Buy and Sell Bitcoin, Ethereum, and more with trust'
          - '<title>Coinbase</title>'
          - 'Sign in to Coinbase'
          - 'Log in to Coinbase'
        condition: or

      - type: word
        part: body
        words:
          - 'password'
          - 'signin'
          - 'sign-in'
          - 'login'
          - 'log-in'
        condition: or

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"coinbase.com")'
          - '!contains(host,"coinbase.co")'
# digest: 4a0a00473045022100f7b813299d62ac6be88cdb094ae5158ccd9e39d17fd7a540e4101c0da275801d022022451df9cd38e6729e453af0b33c1c2273ab3fc318a45b00d9d8b8a360c37db4:922c64590222798bb761d5b6d8e72950