id: oracle-cloud-phish

info:
  name: Oracle Cloud phishing Detection
  author: rxerium
  severity: info
  description: |
    An Oracle Cloud phishing website was detected
  reference:
    - https://oracle.com/cloud
  metadata:
    max-request: 1
  tags: phishing,oracle-cloud,cloud,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "fw_error_www"

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"oracle.com")'
          - '!contains(host,"oraclecloud.com")'
# digest: 490a0046304402207327de44eb2658e143a2e088785da89ef0d66c27e17cf96295d2e31f0f05225d02202d59b90ac190d52b0df6bf4eda9f2d3d271c01770fbd6bf2a4e758beb0d78f70:922c64590222798bb761d5b6d8e72950