id: patreon-phish

info:
  name: Patreon phishing Detection
  author: rxerium
  severity: info
  description: |
    A Patreon phishing website was detected
  reference:
    - https://patreon.com
  metadata:
    max-request: 1
  tags: phishing,patreon,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Patreon is the best place to build community with your biggest fans, share exclusive work, and turn your passion into a lasting creative business."

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"patreon.com")'
# digest: 4b0a00483046022100d076e09f99a901e97f6f6c2eee263a47d4109446d09babd7090963b011472f88022100c82541b9c2eefbef64e5c7dfbf950f0225f7a38b79952aec4f26bc14cdbac215:922c64590222798bb761d5b6d8e72950