id: ea-phish

info:
  name: EA phishing Detection
  author: rxerium
  severity: info
  description: |
    An EA phishing website was detected
  reference:
    - https://ea.com
  metadata:
    max-request: 1
  tags: phishing,ea,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "We exist to inspire the world through Play. Electronic Arts is a leading publisher of games on Console, PC and Mobile."

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"ea.com")'
# digest: 4b0a004830460221009fb4ad2426026b1dcad1f17010279325a19ffbed52dc57e41887f35197616b82022100f6afd438cf068312f92563525ffc05b6fd3577d7e634d7a5a6a269cfc6b8c99e:922c64590222798bb761d5b6d8e72950