id: latemodel-restoration-phish

info:
  name: Late Model Restoration phishing Detection
  author: rxerium
  severity: info
  description: |
    A Late Model Restoration phishing website was detected
  reference:
    - https://lmr.com
  metadata:
    max-request: 1
  tags: phishing,latemodel-restoration,ecommerce,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "lmr.com"
          - '<title>Ford Mustang Parts &amp; Accessories | Late Model Restoration'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"lmr.com")'
# digest: 4a0a00473045022100ae9f6f69e0b7e1b73d1de7896b091922f1c10b5dcd25eebd014ecb06d52b605b0220696b5a14e9c622fbf55d1913794e734603db70d040b66e938bf3d3bd18f05988:922c64590222798bb761d5b6d8e72950