An Post Phishing Kit 7b94e511

Detects an An Post phishing kit that uses the same fake tracking ID across multiple domains.

References

IOK Rule (edit) 

title: An Post Phishing Kit 7b94e511
description: |
  Detects an An Post phishing kit that uses the same fake tracking ID across multiple domains.

references:
  - https://urlscan.io/result/afcfc428-0f35-4b2d-8a52-52da04bd80a2
  - https://urlscan.io/result/7b94e511-dd03-49c1-88d7-47a1663483fa/
  - https://urlscan.io/result/9d5626fa-eb04-4420-834c-23080f5c4124/

detection:

  fakeTrackingId:
    html|contains: '<form action="Details.php?tracking=372837491"'

  condition: fakeTrackingId

tags:
  - kit
  - target.anpost