
Summary
This rule detects inbound messages that impersonate Partiful invitations by embedding Partiful-hosted imagery while removing all links back to Partiful domains. It triggers when HTML image sources resolve to getpartiful.com, partiful.com, or partiful-posters.imgix.net and when there are zero links whose href_url domain root_domain is partiful.com or getpartiful.com. The aim is to catch brand impersonation attempts using legitimate branding imagery without authentic Partiful backlinks, a common social-engineering tactic to mislead recipients and harvest credentials. The detection uses content analysis (HTML), URL analysis, and image source validation to distinguish genuine Partiful invitations from clones. It relates to other brand impersonation rules across evite-like invitations.
Categories
- Web
Data Sources
- Image
- Script
Created: 2026-10-27