id: onlyfans-phish

info:
  name: OnlyFans phishing Detection
  author: rxerium
  severity: info
  description: |
    An OnlyFans phishing website was detected
  reference:
    - https://onlyfans.com
  metadata:
    max-request: 1
  tags: phishing,onlyfans,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '<title>OnlyFans'
          - 'OnlyFans is the social platform revolutionizing creator and fan connections. The site is inclusive of artists and content creators from all genres and allows them to monetize their content while developing authentic relationships with their fanbase.'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"onlyfans.com")'
# digest: 4a0a00473045022056811d09f29801b79df78d92844b7abb78f075d97ef2cae27d527e630e36ef8402210087d80737019db80d28746f9b44f7aa8b27e6880927cf4b57d3db14fa24143ae2:922c64590222798bb761d5b6d8e72950