The rule monitors inbound communications for URLs that point to eventcreate.com and requires that the final rendered page contains outbound links to domains registered within the last 30 days. This pattern suggests the legitimate EventCreate service is being repurposed to host and pivot traffic to freshly created phishing infrastructure. Detection relies on multiple signals: (1) URL analysis to identify eventcreate.com in the inbound message, (2) HTML analysis to inspect the final page’s outbound links, and (3) Whois data to determine the age of linked domains (days_old < 30). Additionally, the rule can trigger when ML-based link_analysis determines a final DOM disposition of phishing. The combination indicates credential phishing activity via an out-of-band pivot using a trusted service, and is categorized under Credential Phishing with a technique of Out of Band Pivot. Detection methods include URL analysis, Whois lookups, and HTML/DOM analysis to surface suspicious, newly registered domains tied to a legitimate service.