id: thunderbird-phish info: name: thunderbird phishing Detection author: rxerium severity: info description: | A thunderbird phishing website was detected reference: - https://thunderbird.net metadata: max-request: 1 tags: phishing,thunderbird,osint http: - method: GET path: - "{{BaseURL}}" host-redirects: true max-redirects: 2 matchers-condition: and matchers: - type: word words: - 'Thunderbird — Free Your Inbox. — Thunderbird' - type: status status: - 200 - type: dsl dsl: - '!contains(host,"thunderbird.net")' # digest: 4b0a00483046022100ca04736e46a0947b3b7f23105b7adb4851f7ea8077c21187029ac093300b3cc1022100f0eb7eabaa0c2c085667c40cf30f5962cf8bc0b7dfb32fc2fe3c09202d4e9e84:922c64590222798bb761d5b6d8e72950