id: gcp-phish

info:
  name: Google Cloud Platform phishing Detection
  author: rxerium
  severity: info
  description: |
    A Google Cloud Platform phishing website was detected
  reference:
    - https://cloud.google.com
  metadata:
    max-request: 1
  tags: phishing,gcp,google-cloud,cloud,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Meet your business challenges head on with cloud computing services from Google, including data management, hybrid & multi-cloud, and AI & ML."

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"cloud.google.com")'
          - '!contains(host,"google.com")'
# digest: 4a0a004730450221008fbf485c46257c74c8278c45622f04085a5c8d46ac29c15ad38e38104bee2016022015b350409bcd1c6bb18fe03623989a54f2891c0602d6fe8e63829d91bff6dec7:922c64590222798bb761d5b6d8e72950