id: newegg-phish

info:
  name: Newegg phishing Detection
  author: rxerium
  severity: info
  description: |
    A Newegg phishing website was detected
  reference:
    - https://newegg.com
  metadata:
    max-request: 1
  tags: phishing,newegg,ecommerce,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Shop Newegg today for all of your gaming, PC & technology needs. Don’t miss today’s best electronics deals with fast shipping & great customer service!"

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"newegg.com")'
# digest: 4a0a0047304502205f8057c007b294697441c7da02d9cc97953cbf7808e9ce440f93d06b7f21ccd902210082d03e89f0e323553c912d75c00024b41c5eefce715ced3b34b9f9435850a281:922c64590222798bb761d5b6d8e72950