id: medium-phish

info:
  name: Medium phishing Detection
  author: rxerium
  severity: info
  description: |
    A Medium phishing website was detected
  reference:
    - https://medium.com
  metadata:
    max-request: 1
  tags: phishing,medium,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Medium: Read and write stories.'
          - 'Medium'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"medium.com")'
# digest: 4a0a0047304502210095f47c823ca62028b5cc8bb60151440b0fe96ce2df088d5366474137fbc8ad3a022049d02eb71ee23b87636e0b28475f6c57e87f59e377d44b6d37c9c5dc8a2e45cb:922c64590222798bb761d5b6d8e72950