KuCoin Phishing Kit 8fo0kgp3

Detects a KuCoin phishing kit deployed often on replit.com.

References

IOK Rule (edit) 

title: KuCoin Phishing Kit 8fo0kgp3
description: |
    Detects a KuCoin phishing kit deployed often on replit.com.

references:
    - https://urlscan.io/result/768a3795-b37c-44c4-9ff3-8bd14dc0ec97

detection:

    title:
      html|contains:
        - <title>Iniciar Sesión | KuCoin</title>

    form:
      html|contains|all:
        - form action="step.php" method="post"
        - class="cointer"

    loginEmail:
      html|contains|all:
        - <a href="celu.html">Celular</a>
        - <td id="db">Email</td>
        - <td id="dc">con codigo QR</td>

    loginPhone:
      html|contains|all:
        - <td id="da">Celular</td>
        - <a href="ku.html">Email</a>
        - <td id="dc">con codigo QR</td>

    condition: title and form and (loginEmail or loginPhone)

tags:
  - kit
  - target.kucoin
  - target_country.argentina