This rule detects email-based brand impersonation targeting the Greetings Island evite service. It uses three main detection vectors: (1) HTML/CDN evidence of Greetings Island assets, by checking body.html for greetingsisland.com and verifying image sources reference the same domain; (2) textual branding cues in the thread, by spotting a greetings island copyright/footer reference (e.g., ©, (c), or copyright) in body.current_thread.text; and (3) visual/logo clues from a message screenshot, utilizing image-brand detection to flag an Invite Company logo with non-low confidence and cross-checking for greetings island cues via text or beta OCR of the screenshot. If any of these signals indicate Greetings Island branding, the rule triggers a potential impersonation. The rule includes safeguards to reduce false positives: it excludes legitimate Greetings Island senders (sender.email.domain.root_domain ==