id: humble-bundle-phish

info:
  name: Humble Bundle phishing Detection
  author: rxerium
  severity: info
  description: |
    A Humble Bundle phishing website was detected
  reference:
    - https://humblebundle.com
  metadata:
    max-request: 1
  tags: phishing,humble-bundle,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Humble Bundle sells games, books, software, and more. Our mission is to support charity while providing awesome content to customers at great prices. Since 2010, Humble Bundle customers have given over $275,000,000 to charity."

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"humblebundle.com")'
# digest: 490a00463044022055a71cf1887d38601f9f6db366324e2e24a16ab67a551d44b14b33f3bccce62d0220102239501cb4e32dfbb9f14e665d0e0e47d24389b6d1e0a0714484812b12f37e:922c64590222798bb761d5b6d8e72950