id: mcafee-phish info: name: mcafee phishing Detection author: rxerium severity: info description: | A mcafee phishing website was detected reference: - https://mcafee.com tags: phishing,mcafee http: - method: GET path: - "{{BaseURL}}" host-redirects: true max-redirects: 2 matchers-condition: and matchers: - type: word words: - 'Antivirus, VPN, Identity & Privacy Protection | McAfee' - type: status status: - 200 - type: dsl dsl: - '!contains(host,"mcafee.com")'