Even the 'Block this Host' Link Went to the Phishing Page

A lookalike Evite RSVP sent to a US small-business fintech lender contained 13 clickable anchors that all resolved to the same malicious domain (aalzntp.vu), and the recipient platform's link deduplication collapsed those anchors into a single 'View & RSVP' entry, hiding the hostile links; SPF/DKIM/DMARC/ARC passed, making the message appear authentic. The report highlights this phishing tactic, provides the URL/domain indicator and subject line, and recommends treating the entire message body as suspect, hovering all links, and opening the platform directly rather than clicking in the message.