id: menards-phish

info:
  name: Menards phishing Detection
  author: rxerium
  severity: info
  description: |
    A Menards phishing website was detected
  reference:
    - https://menards.com
  metadata:
    max-request: 1
  tags: phishing,menards,ecommerce,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Menards'
          - 'title>Home at Menards&#174;'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"menards.com")'
# digest: 4a0a00473045022100b728f3503a6ce68020d87e03c68a3f9b0c3f28b48a869a0dffdd7b07c3980eb1022056125cbdf1aa88b72cff153b0ad53756cbb0c00c181fae5ce0d2f755bd36524e:922c64590222798bb761d5b6d8e72950