diff --git a/indicators/discord-fake-404-kit.yml b/indicators/discord-fake-404-kit.yml new file mode 100644 index 00000000..9d160a9f --- /dev/null +++ b/indicators/discord-fake-404-kit.yml @@ -0,0 +1,25 @@ +title: Discord Fake 404 Kit +description: | + Detects a fake 404 page that is used on Discord phishing templates. These sites often have hidden paths of /login with a fake Discord login. +references: + - https://urlscan.io/result/43143a94-ee73-46da-a877-e0f0e5eb5d0c/ + - https://urlscan.io/result/d360ec5c-ec44-484e-8bf5-7ad3a296adbb/ + - https://urlscan.io/search/#page.title%3A%22Page%20Not%20Found%20%7C%20404%22 + +detection: + + pageTitle: + title: "Page Not Found | 404" + + pageHTML: + html|contains|all: + - "Page Not Found | 404" + - "https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap" + - "This page was not found, please try again later!" + - "

PAGE NOT FOUND!

" + + condition: pageTitle and pageHTML + +tags: + - kit + - target.discord