Save Page WE website saver

Recent Detections

• hxxps://mpshining[.]com/DK

  urlscan.io
• hxxps://borgeseadorno[.]com/Afcu/login.php?online_id=2994072e04f...

  urlscan.io
• hxxps://deine[.]dbk[.]de-log[.]session-live[.]ru/true_session/

  urlscan.io
• hxxps://amendegouvernement[.]com/

  urlscan.io
• hxxps://amendegouvernement[.]com/app/pages/index.php

  urlscan.io
• hxxps://serressergedupuis[.]com/wp/privacy-policy/login.html

  urlscan.io
• hxxps://serressergedupuis[.]com/wp/privacy-policy/

  urlscan.io
• hxxps://hilfe-sparkasse[.]de/de/6415cf8d9e6ef

  urlscan.io
• hxxps://arbitrum-airdrop[.]net/

  urlscan.io
• hxxps://www[.]asaltulcetatii[.]ro/ok

  urlscan.io

IOK Rule (edit)

title: Save Page WE website saver
description: |
  Save Page WE is a chrome extension used by phishers to clone a target website and save it as a single HTML file.
  
  Unlike HTTrack (another commonly used tool):
  * It's a browser extension so doesn't require any additional tools to be installed.
  * It saves pages as a single HTML file (with all assets embedded in it) which makes the resulting kit more portable and easier to deploy.
references:
  - https://chrome.google.com/webstore/detail/save-page-we/dhhpefjklgkmgeafimnjhojgjamoafof
related:
  - httrack

detection:
  cssComment:
    html|contains: "/*savepage-url="

  metaComments:
    html|contains:
      - "<meta name=\"savepage-url\" content=\""
      - "<meta name=\"savepage-title\" content=\""
      - "<meta name=\"savepage-pubdate\" content=\""
      - "<meta name=\"savepage-from\" content=\""
      - "<meta name=\"savepage-date\" content=\""
      - "<meta name=\"savepage-state\" content=\""
      - "<meta name=\"savepage-version\" content=\""
      - "<meta name=\"savepage-comments\" content=\""
  condition: cssComment or metaComments

tags:
  - cloning