Brand impersonation: Evite

type.inbound
and strings.icontains(body.html.raw, 'evite')
and any(html.xpath(body.html, '//img/@src').nodes,
        // calling parse_url allows url decoding to help us
        strings.parse_url(.raw).domain.root_domain in (
          'evitecdn.com',
          'evite.com'
        )
)
and length(filter(body.links,
                  .href_url.domain.root_domain == "evite.com"
                  and regex.imatch(.href_url.path, '/_ct/[a-f0-9]{40}/')
           )
) <= 4
and not (
  (subject.is_forward or subject.is_reply)
  and (length(headers.references) != 0 or headers.in_reply_to is not null)
  and length(body.previous_threads) > 0
)
and not (
  sender.email.domain.root_domain == "evite.com"
  and coalesce(headers.auth_summary.dmarc.pass, false)
)