id: comerica-phish

info:
  name: Comerica Bank phishing Detection
  author: rxerium
  severity: info
  description: |
    A Comerica Bank phishing website was detected
  reference:
    - https://comerica.com
  metadata:
    max-request: 1
  tags: phishing,comerica,bank,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Comerica'
          - 'Your partner for personal finance, business banking, and wealth management with a legacy of excellence and industry recognition.'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"comerica.com")'
# digest: 4a0a00473045022100d2d8f617f39b90538403815c0126a91d185f662297201a11c10b6e759d95f86902203f9a8c7022c77a5e62e373e7cdc60eeb7d52fd194b4904ad23732c1d2f8133c4:922c64590222798bb761d5b6d8e72950