🚀 Create discord-fake-404-kit.yml

Detects a fake 404 page that is used on Discord phishing templates. These sites often have hidden paths of /login with a fake Discord login.
phish-report · Jul 2, 2024 · ea08e91 · ea08e91
1 parent 1373aed
commit ea08e91
Showing 1 changed file with 25 additions and 0 deletions.
diff --git a/indicators/discord-fake-404-kit.yml b/indicators/discord-fake-404-kit.yml
@@ -0,0 +1,25 @@
+title: Discord Fake 404 Kit
+description: |
+  Detects a fake 404 page that is used on Discord phishing templates. These sites often have hidden paths of /login with a fake Discord login.
+references:
+    - https://urlscan.io/result/43143a94-ee73-46da-a877-e0f0e5eb5d0c/
+    - https://urlscan.io/result/d360ec5c-ec44-484e-8bf5-7ad3a296adbb/
+    - https://urlscan.io/search/#page.title%3A%22Page%20Not%20Found%20%7C%20404%22
+
+detection:
+
+  pageTitle:
+    title: "Page Not Found | 404"
+
+  pageHTML:
+    html|contains|all:
+      - "<head><title>Page Not Found | 404</title>"
+      - "https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap"
+      - "This page was not found, please try again later!"
+      - "<h1>PAGE NOT FOUND!</h1>"
+
+  condition: pageTitle and pageHTML
+
+tags:
+  - kit
+  - target.discord