id: square-phish

info:
  name: Square phishing Detection
  author: rxerium
  severity: info
  description: |
    A Square phishing website was detected
  reference:
    - https://squareup.com
  metadata:
    max-request: 1
  tags: phishing,square,payment,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Sell anywhere. Diversify revenue streams. Streamline operations. Manage your staff. Get paid faster. Sign up for Square today."
          - 'Square Dashboard'
        condition: or

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"squareup.com")'
          - '!contains(host,"square.com")'
# digest: 490a00463044022051d43b736fbe56927e0b4c9c7c0b13507d368a8e02edb872ef770105c7e8ab7d022058f215ab2d2f49677e7933e09cf326ccbfb3d1be72b6f7f3fa16f6c8c30b7062:922c64590222798bb761d5b6d8e72950