id: crunchyroll-phish

info:
  name: Crunchyroll phishing Detection
  author: rxerium
  severity: info
  description: |
    A Crunchyroll phishing website was detected
  reference:
    - https://crunchyroll.com
  metadata:
    max-request: 1
  tags: phishing,crunchyroll,streaming,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'crunchyroll.com'
          - 'Crunchyroll'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"crunchyroll.com")'
# digest: 490a00463044022050dd9d8bca0245ff9e4ffc8d2bcb6a9571d38be0997fcd4d6409ef3511ccd31d02201a09e27ada5ffe7cce1c9553983f83e00b14a93d84cee4779011ff5907224d85:922c64590222798bb761d5b6d8e72950