id: mcafee-phish info: name: mcafee phishing Detection author: rxerium severity: info description: | A mcafee phishing website was detected reference: - https://mcafee.com metadata: max-request: 1 tags: phishing,mcafee,osint http: - method: GET path: - "{{BaseURL}}" host-redirects: true max-redirects: 2 matchers-condition: and matchers: - type: word words: - 'Antivirus, VPN, Identity & Privacy Protection | McAfee' - type: status status: - 200 - type: dsl dsl: - '!contains(host,"mcafee.com")' # digest: 4b0a00483046022100fae519ded008b73c8da9f8d7e66ebc98d4188fe67df22ad90ede994a71cea26c022100f5645d8c10273081edf8b0c070b2fd5cba14081db1e95fa539d38c0a2d6e1584:922c64590222798bb761d5b6d8e72950