id: uob-phish

info:
  name: UOB phishing Detection
  author: rxerium
  severity: info
  description: |
    A UOB phishing website was detected
  reference:
    - https://uob.com.sg
  metadata:
    max-request: 1
  tags: phishing,uob,bank,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "United Overseas Bank"

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"uob.com.sg")'
# digest: 4b0a00483046022100a09cfe47e5fbae47b84790fe43b9fa9c31b7c3e50fc86ed16053124925655ed5022100d7bbc07bb545cf240c859f38e03d8a3a61c86c1d8971136674c7e7365564eb31:922c64590222798bb761d5b6d8e72950