id: cibc-phish

info:
  name: CIBC phishing Detection
  author: rxerium
  severity: info
  description: |
    A CIBC phishing website was detected
  reference:
    - https://cibc.com
  metadata:
    max-request: 1
  tags: phishing,cibc,bank,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'CIBC'
          - 'CIBC U.S. provides tailored commercial and personal banking services, private wealth management and small business financial solutions from coast to coast. We invest in businesses, people and communities, striving to build trusting and enduring relationships by putting our clients at the center of all we do.'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"cibc.com")'
# digest: 490a0046304402201c4e5ff23274899e446dda29b01302887d91aa8195a9f223b6b05035c434aaa7022001146ad7bdd9f4c94784b3bd4f716edd1389fbc675fe4d0e86242e4713854dc4:922c64590222798bb761d5b6d8e72950