id: ghost-blog-detection
info:
  name: Ghost blog detection
  author: pdteam
  severity: info


flow: dns() && http()

dns:
  - name: "{{FQDN}}"
    type: CNAME

    extractors:
      - type: dsl
        name: cname
        internal: true
        dsl:
            - cname
        
http:
  - method: GET
    path:
      - "{{BaseURL}}?ref={{cname}}"

    matchers:
      - type: word
        words:
          - "ghost.io"