Even the 'Block this Host' Link Went to the Phishing Page

Thirteen links. Zero of them went to Evite.

The card looked like an invitation: "Submit Your RSVP," a dinner party, a reply-by date of August 10, 2026, and an event on Friday, August 14. It reached an employee at a US small-business fintech lender with the recipients hidden in Bcc. Every anchor in it, from the big RSVP button to the legal footer, pointed to the same path: hxxps://aalzntp[.]vu/aut.

That detail is the whole story. Attackers have always planted one bad link behind a button. This one booby-trapped the exits too.

The exits are the trap

Think about how a cautious person handles a notification they did not expect. They skip the bright button. They scroll to the bottom and look for the way out: Privacy Policy, Event Notification Settings, Block this Host, Do Not Sell My Info.

Here, all of those pointed to the same page as "View & RSVP." So did "See Who's Coming," "Add to calendar," both app store badges, the Instagram, TikTok and Pinterest icons, and the postal address line. Even the address of the impersonated brand was a hyperlink to the attacker's path.

The reader's instinct to be careful had nowhere safe to land. Caution just changed which part of the card got clicked.

This is a different problem from a card with one or two swapped links. Spot-checking a couple of hrefs would never have cleared this message, because there was nothing clean to find.

What the platform showed

The message's link inventory told a different, quieter story. It listed three links: the sender's own signature website over HTTPS and HTTP, both scanned Clean, and one aalzntp[.]vu entry labelled "View & RSVP" with a Mixed Result and a partial verdict.

Thirteen anchors had been deduplicated into one record, labelled with the text of the first button. A reviewer reading that list sees one suspicious link and two clean ones. The Block this Host anchor, the privacy anchors and the address anchor never appear as separate rows.

That is a visibility gap, and it is worth naming plainly. Deduplication is sensible for performance. It is misleading when the question a human is asking is "what did the footer do?"

Themis, the IRONSCALES agentic AI virtual SOC analyst, flagged the message at 50% confidence under the label VIP Recipient and named View & RSVP as the malicious link. A human analyst then resolved the incident as malicious. The automated confidence was modest. The structure of the message is what made the call easy once someone opened the body.

Mechanics and authentication

The message was a hand-built imitation. Logos, the App Store badge and the social icons were hotlinked from Evite's own image host, which is how a pasted HTML copy looks convincing. One image broke the pattern: the Google Play badge came from a third-party website asset host rather than from Evite. It is a small assembly tell, and the host itself is ordinary shared infrastructure.

The footer reproduced Evite's boilerplate, including the copyright line. Evite was impersonated here. Nothing in the record suggests its platform was breached or abused.

The sender side is the part that defeats simple filters. The message came from a real Google Workspace mailbox belonging to an unrelated small business that had prior correspondence with the recipient organization. At the final hop, SPF passed, DKIM passed, DMARC passed with a none policy, and ARC passed. A legitimate third-party business mailbox sent it. The record does not establish why, and this post does not accuse that business of anything. Most likely the account was misused, but that is not proven.

What the landing page served was not established either. No screenshot or form was captured, so this analysis names no payload.

The mapping is T1566.002 (Spearphishing Link) for delivery, with the recipient's click as the user execution step (T1204.001). Link-based phishing remains the dominant shape of the problem: the 2026 Verizon Data Breach Investigations Report shows 80% of the email gateway attack mix is plain phishing, and 62% of breaches involve the human element.

See Your Risk: Calculate how many threats your SEG is missing

Indicators

There is no safe place to click

The defensive lesson is blunt. On a lookalike notification, every element is attacker-controlled, so every element is suspect. "Don't click the button, click unsubscribe instead" is advice that this message was designed to exploit.

Three habits hold up:

• Treat the whole body as one surface. If you did not expect the invitation, do not click anywhere in it. Open the platform in a browser or app and look for the event yourself.
• Hover every link you are asked to trust, not just the call to action, and read the destination host. Thirteen identical destinations is a finding by itself.
• When you review a link list, ask how many anchors each row represents. A single deduplicated record can stand for a whole message.

Authentication results will not rescue you here. The FBI IC3 2024 report and CISA's phishing guidance both stress that credible-looking messages from real accounts are how phishing keeps working. The Microsoft Digital Defense Report 2024 and the IBM Cost of a Data Breach 2024 make the same point from the cost side: stolen credentials and phishing sit at the front of expensive incidents.

For security teams, this is an argument for content-level analysis over reputation shortcuts. Adaptive AI that reads the whole message and its link structure sees what a sender-reputation check cannot: a card that authenticates perfectly and has no honest link in it. A SEG augmentation layer is built for that gap, and the NIST definition of phishing is a useful reminder that the deception is the point, not the infrastructure. For background on the tactic, see the IRONSCALES glossary entry on phishing.

IRONSCALES platform data reflects a community of 36,000+ security professionals across 18,000+ organizations, and cases like this one are exactly why analyst verdicts and automated link analysis need to disagree out loud when they do.