id: loaded-phish

info:
  name: Loaded phishing Detection
  author: rxerium
  severity: info
  description: |
    A Loaded phishing website was detected
  reference:
    - https://loaded.com
  metadata:
    max-request: 1
  tags: phishing,loaded,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Enjoy instant delivery, exclusive discounts, and the same unbeatable prices on PC, Xbox, PlayStation & Nintendo."

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"cdkeys.com")'
          - '!contains(host,"loaded.com")'
# digest: 4a0a00473045022100b55e56c5270e670f2bf8ae47b00f8f55a5e6d436cb8221a7f9e893c7e57046210220116a4ada0e50d4b29768e61bad29ef7ee0f04dcc69ded451f94e86e64c20ec1a:922c64590222798bb761d5b6d8e72950