id: expressvpn-phish

info:
  name: ExpressVPN phishing Detection
  author: rxerium
  severity: info
  description: |
    A ExpressVPN phishing website was detected
  reference:
    - https://expressvpn.com
  metadata:
    max-request: 1
  tags: phishing,expressvpn,vpn,osint,discovery
http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '<title>ExpressVPN: Best VPN Service for Speed & Privacy in 2025'

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - '!contains(host,"expressvpn.com")'
# digest: 490a0046304402201f86154b7d7bfe6fb3528d550fd7fdc612fbfa2cedc024ff9e18aa65e3c5584302203e2f215c31fdeb64d28830eaf9f503f516fcc4e096375f359bd9048fab48ef1f:922c64590222798bb761d5b6d8e72950