Fake crypto giveaway coin selection b791myo4

Detects a scam giveaway landing page which claims to host a large cryptocurrency event. Sometimes the scammer will pick a specific cryptocurrency to target, but in this case they decided to add a menu where the user can select a specific coin.

References

IOK Rule (edit) 

title: Fake crypto giveaway coin selection b791myo4
description: |
    Detects a scam giveaway landing page which claims to host a large cryptocurrency event.
    Sometimes the scammer will pick a specific cryptocurrency to target, but in this case they decided to add a menu where the user can select a specific coin.
references:
    - https://urlscan.io/result/2d36df23-6af6-4315-b4fa-7540f59e37a0/
    - https://urlscan.io/result/ab98ee0e-8b82-4a9e-8cf5-bafab9a135a5/
    - https://urlscan.io/result/0f499d45-6050-49ea-87e0-0ada06245a87/
    - https://urlscan.io/result/e1d12d03-7da3-413e-9368-fed1c87ff7e1/
    - https://urlscan.io/result/ca8b41ca-46a7-4811-ac53-cf0efcaa7405/

detection:

    title:
      html|contains:
        - <title>Choose a coin</title>

    cssUrlencoded:
      html|contains|all:
        - link rel="stylesheet" href="Choose%20a%20coin_files/font.css"
        - link rel="stylesheet" href="Choose%20a%20coin_files/style_v_12.css"

    css:
      html|contains|all:
        - link rel="stylesheet" href="./Choose a coin_files/font.css"
        - link rel="stylesheet" href="./Choose a coin_files/style_v_12.css"

    classes:
      html|contains|all:
        - class="join-title"
        - class="join-subtitle"
        - class="join-buttons"
        - class="join-button"

    icon:
      requests|contains:
        - link rel="icon" type="image/png" href="images/fav.png"

    backgroundUrl:
      requests|contains:
        - img/background.png

    condition: title and (cssUrlencoded or css) and classes and (icon or backgroundUrl)

tags:
  - kit
  - cryptocurrency
  - cryptocurrency.bitcoin
  - cryptocurrency.ethereum
  - cryptocurrency.doge