Avis Phishing Kit 0fbd3ca

Detects an Avis phishing kit targeting Turkish users.

References

IOK Rule (edit) 

title: Avis Phishing Kit 0fbd3ca
description: |
    Detects an Avis phishing kit targeting Turkish users.
    
references:
    - https://urlscan.io/result/0fbd3caa-14be-4565-ad9f-d11d7ec0fdf5
    - https://urlscan.io/result/5d146af9-5f2a-4544-a650-a014a3cdd671

detection:

  whatsAppHref: 
    html|contains|all: 
        - 'https://api.whatsapp.com/send?phone='
        - 'Merhaba'
        - 'https://wa.me'

  jivoWidget:
    requests|contains: 'rn1GDc154Q'
    
  condition: whatsAppHref and jivoWidget

tags:
  - kit
  - target_country.turkey
  - target.avis