id: trip-phish info: name: trip phishing Detection author: rxerium severity: info description: | A trip phishing website was detected reference: - https://trip.com tags: phishing,trip,osint http: - method: GET path: - "{{BaseURL}}" host-redirects: true max-redirects: 2 matchers-condition: and matchers: - type: word words: - 'Trip.com: Book cheap flights, hotels, car rentals, trains and more' - type: status status: - 200 - type: dsl dsl: - '!contains(host,"trip.com")' # digest: 4a0a00473045022056d07a6df2644b48bb0c57ea3f4c87693c8e3d86fd43d39aed7a20e589171cac022100ff83ceef5334bc8853b13d0e4e80ed8d48d42cfe5e6545e51b3d3935624f1dd2:922c64590222798bb761d5b6d8e72950