Brand impersonation: Partiful

type.inbound
// Partiful-hosted imagery retained from the genuine invitation template
and any(html.xpath(body.html, '//img/@src').nodes,
        // calling parse_url allows url decoding to help us
        strings.parse_url(.raw).domain.root_domain in (
          'getpartiful.com',
          'partiful.com'
        )
        or strings.parse_url(.raw).domain.domain == 'partiful-posters.imgix.net'
)
// a genuine invitation always links back to Partiful; a clone rewrites every href
and length(filter(body.links,
                  .href_url.domain.root_domain in (
                    'partiful.com',
                    'getpartiful.com'
                  )
           )
) == 0