id: santander-phish

info:
  name: Santander Bank phishing Detection
  author: rxerium
  severity: info
  description: |
    A Santander Bank phishing website was detected
  reference:
    - https://santander.com
  metadata:
    max-request: 1
  tags: phishing,santander,bank,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Our purpose is to help people and businesses prosper. We strive to make all we do Simple, Personal and Fair."

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"santander.com")'
# digest: 4b0a00483046022100ad82056306b4308977d5445bcb4d8607517c4ce8d00f23c83428afc6201c7e95022100d26ec5d9fc61fdeff6e57015a4c47a76407347ed8eefded10c278e330a9786b3:922c64590222798bb761d5b6d8e72950