id: ceros-takeover

info:
  name: ceros takeover detection
  author: abison_binoy
  severity: info
  tags: takeover
  reference:
    - https://twitter.com/abison_binoy/status/1412606224030339072
    - https://www.ceros.com/educate/help_center/using-your-own-vanity-domain/

requests:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        words:
          - "Sorry, page not found"
          - "Please check the url and"
          - "/view.ceros.com/"
        condition: and