id: sams-club-phish

info:
  name: Sam's Club phishing Detection
  author: rxerium
  severity: info
  description: |
    A Sam's Club phishing website was detected
  reference:
    - https://samsclub.com
  metadata:
    max-request: 1
  tags: phishing,sams-club,ecommerce,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Shop Samsclub.com today for Every Day Low Prices. Join Sam's Club as a Plus Member and get free same-day or next-day delivery from your club & free shipping on eligible items totaling $50 or more."

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"samsclub.com")'
# digest: 490a00463044022008a67195af2030b72b053c7560b86eb5fad80be925c12f8656390de9f3ca4b9602205ebe3a6067e6a544ebb1f432fe493bbc78c773c18415ad387cdea52d6cd8b759:922c64590222798bb761d5b6d8e72950