Image-only PDF links to deceptive (typosquat) host

Screenshot-like phishing/fake-update PDFs render an image and a single clickable action whose destination host impersonates a security, service, or brand word using a leetspeak digit in place of a letter (e.g. 'serv1ce', 'l0gin', 'm1crosoft', 'payp4l'). The rule fires only when the document is image-only with little real text AND the destination is not a known-good (Tranco/allowlisted) domain, so a legitimate flyer linking to its real site is unaffected. The digit-for-letter substitution is the deception tell.