id: ghost-blog-detection
info:
name: Ghost blog detection
author: pdteam
severity: info
flow: dns() && http()
dns:
- name: "{{FQDN}}"
type: CNAME
matchers:
- type: word
words:
- "ghost.io"
internal: true
http:
- method: GET
path:
- "{{BaseURL}}"