id: ocbc-phish

info:
  name: OCBC Bank phishing Detection
  author: rxerium
  severity: info
  description: |
    An OCBC Bank phishing website was detected
  reference:
    - https://ocbc.com
  metadata:
    max-request: 1
  tags: phishing,ocbc,bank,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Discover a world of financial services with OCBC, the best trusted and established Singapore bank. Explore our range of banking solutions today."

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"ocbc.com")'
# digest: 4a0a00473045022066d48c0b56f0d22f3576e5938a0e1dec4fa20cfe4b9258e37a1880aeb70c527a022100f8f89c74134b11ec839b87a455523bc24c241ca524796f631f000a44d860c4d9:922c64590222798bb761d5b6d8e72950