id: uplay-phish

info:
  name: Uplay phishing Detection
  author: rxerium
  severity: info
  description: |
    A Uplay phishing website was detected
  reference:
    - https://ubisoft.com
  metadata:
    max-request: 1
  tags: phishing,uplay,ubisoft,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Welcome to the official website for Ubisoft, creator of Assassin's Creed, Just Dance, Tom Clancy's video game series, Rayman, Far Cry, Watch Dogs and many others. Learn more about our breathtaking games here!"

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"ubisoft.com")'
# digest: 4b0a00483046022100ed7b963d7cd9f1367ebec1941c49354d5b15af7a62ca0e202433a3855b581b36022100c6af69b051d01bac2450133df4ce3060d2b9d656d3b7b25cddab664fee3d5b3b:922c64590222798bb761d5b6d8e72950