id: dota2-phish

info:
  name: Dota 2 phishing Detection
  author: rxerium
  severity: info
  description: |
    A Dota 2 phishing website was detected
  reference:
    - https://dota2.com
  metadata:
    max-request: 1
  tags: phishing,dota2,steam,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Every day, millions of players worldwide enter battle as one of over a hundred Dota heroes. And no matter if it's their 10th hour of play or 1,000th, there's always something new to discover. With regular updates that ensure a constant evolution of gameplay, features, and heroes, Dota 2 has taken on a life of its own."

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"dota2.com")'
          - '!contains(host,"steampowered.com")'
# digest: 4a0a00473045022100d8deff3ddea4c27a046a80009d13847f1fe8c5266e041966472eec3aa4b9db1902200d46c7d96d97ac9811ad7e9e1636cf2169d019f974b72ad307dea259dd283409:922c64590222798bb761d5b6d8e72950