One Brand's Artwork, A Different Brand's Landing Page

An e-invitation landed in three finance mailboxes at a North American industrial engineering firm one morning, and it rendered flawlessly. The envelope artwork, the button reading "Open your invitation," and a transparent one-pixel image tucked into the footer all loaded from the genuine invitation platform's own content delivery network. Nothing was screenshotted or rebuilt; the pixels were the brand's own.

Every clickable element in that message went somewhere else, and all four went to the same somewhere else: a short path on a domain registered roughly 46 hours earlier.

The page waiting at the end of that link carried a different greeting-card company's branding entirely. That break in brand continuity, not the authentication result, is the case.

Four Anchors, One Destination

Pull the raw body apart and the message contains exactly four links: the invitation artwork, the "Open your invitation" button, the "If you can't see the above invitation, click here" fallback line, and the "Remove yourself" unsubscribe line at the foot of the message.

All four resolve to the same URL. Not one resolves to the invitation platform whose logo sits above them.

The unsubscribe anchor is the one worth sitting with. On a real notification email it is the element a cautious recipient is most likely to click, precisely because clicking it is supposed to be the disengaging choice: I did not ask for this, take me off the list. Here it was wired to the payload alongside everything else. The attacker did not overlook the footer. They rewrote it.

The recipient's own Microsoft Defender Safe Links then rewrote all four hrefs on the way in, preserving each pre-rewrite target in the anchor's originalsrc attribute, which is why this teardown can be exact about them. That rewriter belongs to the defender. It preserved the evidence. It did not block the click.

Real Assets, Borrowed Wholesale

The images were not lookalikes. They were requested live from Punchbowl's static asset host at render time, so the message inherited that host's reputation, its certificate and its clean domain history for free. There is no lookalike domain in the image tags to spot, because there is no lookalike. Punchbowl sent nothing.

The markup also carried the platform's own one-pixel open-tracking beacon, still pointing back at the platform. That is not an attacker telemetry channel. It is a fingerprint of how the lure was built: somebody lifted a genuine invitation email's markup wholesale, kept every asset reference intact so it would render, and swapped only the href values. The tracking pixel came along because nobody bothered to strip it. Both asset paths embed live object identifiers that may belong to a real person's event, so they are described here rather than printed.

See Your Risk: Calculate how many threats your SEG is missing

A Domain Not Yet Two Days Old

WHOIS on the destination returns a creation timestamp roughly 46 hours and 44 minutes before the message's own Date header. A low-cost registrar, Cloudflare name servers, DNSSEC unsigned, on a .online apex domain. It has since picked up both clientHold and serverHold at the registry, the suspension flags that mark an abuse takedown.

Forty-six hours is short enough that no reputation system had accumulated anything to say. Domain age is one of the very few controls that would have fired here, and it only fires if the threshold is enforced rather than logged.

The Landing Page Changed Its Story

The link led onward to a website that had existed for years before this attack: a Brazilian legal practice on shared regional hosting, with no connection to invitations, greeting cards or the recipient. Its age and its line of business rule out attacker registration. Treat that owner as a compromised bystander whose server was borrowed. The attacker supplied the page, not the host.

And the page had changed its mind about which brand it was. The email was an invitation from one platform. The destination was branded as Blue Mountain eCards, reading "You're Invited" above a line promising that the recipient's exclusive eCard would download automatically in three seconds, with a download button beneath it.

Note the mechanism being advertised: an automatic download. Not a sign-in, not a password prompt, no credential form anywhere on the page. This is payload delivery, and the page's only job is to make a file arriving unbidden feel like the ordinary behaviour of a greeting card. What that file was is not in the record, and this teardown will not guess at it.

A recipient who trusted the artwork enough to click arrived at a page that could not keep the story straight for a single hop.

Authentication Was Never The Problem

The sending mailbox belonged to a real electronics and automation installation business in the American Midwest, on a domain registered for the better part of a decade and running on Google Workspace. The message left Google's own outbound relay carrying a genuine signature for that domain, and the recipient's gateway recorded SPF pass, DKIM pass verified, and composite authentication pass with reason 109. The spam stack scored it SCL 1, not spam, category none, and delivered it.

There is no authentication failure to detect on here, because the account was real. That is what account takeover buys an attacker: not a forged header, an honest one. The one soft spot is a DMARC result of bestguesspass rather than pass, meaning the sending domain publishes no record and the receiver inferred an outcome. Worth logging, not worth a rule.

Delivery was by blind copy. The message carried no To: header at all and fanned out to three finance-adjacent mailboxes, an accounts-payable alias among them. A consumer greeting-card invitation, blind-copied to a company's payables function, is a content-context mismatch worth a rule on its own.

What Actually Flagged It

Automated link scanning returned a mixed result with a verdict of partial on both extracted URLs. Not clean, not malicious. The scanners hedged, and a hedge is not an exoneration.

Themis, our Adaptive AI, recorded a recommendation confidence of 90, and the report reached us through the IRONSCALES community rather than through any payload verdict: the community insight on file reads that the community is highly confident the incident is phishing based on how similar incidents resolved elsewhere. That is a cross-tenant reputation call on a message with passing authentication, a clean spam score and no attachment. It was the only control in the path with material to work with.

All three affected mailboxes were mitigated or reverted inside roughly a fourteen-minute window from first delivery, although the platform records no action taken against the messages themselves.

Both the CISA phishing guidance and the NIST definition of phishing frame the threat by deception and elicited action rather than by files and URLs, which is the framing this message demands: on file and URL evidence alone, it passes. The 2024 Verizon Data Breach Investigations Report put the human element in 68 percent of breaches.

What To Take Into Monday

Compare the anchors against the artwork. A notification email whose images come from a brand's real CDN while every href points off-domain is not a gray area, and no threat intelligence is needed to make that comparison. Check the unsubscribe anchor specifically, because it is the one most people assume is safe. Enforce a domain-age threshold and mean it. Treat a mixed scanner verdict as an unanswered question.

Indicators of Compromise

MITRE ATT&CK Mapping