id: csgo-phish

info:
  name: CS:GO phishing Detection
  author: rxerium
  severity: info
  description: |
    A CS:GO phishing website was detected
  reference:
    - https://counter-strike.net
  metadata:
    max-request: 1
  tags: phishing,csgo,steam,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'VALVE_PUBLIC_PATH = "https:\/\/www.counter-strike.net\/\/public\/"'
          - 'https://www.counter-strike.net/public/'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"counter-strike.net")'
          - '!contains(host,"steampowered.com")'
# digest: 4a0a0047304502200e1b33577c0f3502977c3a6067719bca945b780be6da9d2ed0fcc3dc8879ad40022100ec8dc99d3f4407cb0823dd80c1398b68e0633d0ec529fb971c5cc117a40a100c:922c64590222798bb761d5b6d8e72950