Westpac Phishing Kit c5c1bfe0

Westpac phishing kit which uses the same CSS files and directory structure across various domains.

References

IOK Rule (edit) 

title: Westpac Phishing Kit c5c1bfe0
description: |
    Westpac phishing kit which uses the same CSS files and directory structure across various domains.

references:
    - https://urlscan.io/result/0d23637b-49fc-44f8-af76-72f14a101d3a/
    - https://urlscan.io/result/65dabd43-fcf2-4924-bd4c-1641f9919338/
    - https://urlscan.io/result/c5c1bfe0-f3ac-423b-b1f1-00d896c03b2d/
    - https://urlscan.io/result/c034730b-c219-4531-ad57-6e1338e9f81c/

detection:

    stylesheet:
        html|contains|all: 
            - '/front_end/front_end_files/000-000-0001combined.css.1a6232cd07874834478c928fa1f30b79eea8fe08.css'
            - '/front_end/front_end_files/000-0001combined.css.ad465e8be579042cb5c8ec3d4ebc745fbe87f2b4.css'
            - '/front_end/front_end_files/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css'

    shortcutIcon:
        html|contains: '/wbc/banking/Themes/Default/Desktop/WBC/Images/favicon.ico.23fb3f626712cf243b43f34a3e3a8e887b8e8250.ico'

    condition: stylesheet and shortcutIcon

tags:
  - kit
  - target.westpac