Instagram Phishing Kit TPEXkd

IOK Rule (edit)

title: Instagram Phishing Kit TPEXkd
description: |
    Detects a phishing kit targeting Instagram.
    Commonly deployed on Freenom domains.


references:
    - https://urlscan.io/result/b861f41c-57f1-445f-bf6d-d80d84f673b4/
    - https://urlscan.io/result/b7fdc491-68bb-42ed-853b-a24623b3dc5b/
    - https://urlscan.io/result/aa338e86-53b1-4cb5-8c15-aea917601246/
    - https://urlscan.io/result/bb82b60a-3de6-4c71-896a-3349ebbcca4c/

detection:

    icon:
      html|contains:
        - link rel="icon" type="image/png" href="form/img/logom.png"

    logo:
      html|contains:
        - img class="logo" src="form/img/instagram.png" width="190px"

    classes:
      html|contains|all:
        - class="signin-signup"
        - class="sign-in-form"
        - class="inputsevindk"
        - class="yasinbaykam


    condition: icon and logo and classes

tags:
  - kit
  - target.instagram