This rule flags inbound messages that contain links whose domains use suspicious top-level domains (TLDs) and, when analyzed by the URL analysis pipeline, resolve to a benign Wikipedia page. The behavior is characteristic of sandbox/evasion techniques where links detect automated analysis tools and serve harmless content to researchers while delivering malware payloads to real users. The rule targets inbound channels, checks each link in the current thread, verifies that the link's domain.tld belongs to a configured set of suspicious TLDs, and uses the link analysis module (ml.link_analysis) to obtain the final effective URL. If the effective URL equals https://www.wikipedia.org/, the rule triggers. It is categorized under Credential Phishing and Spam with evasion/open-redirect tactics, and relies on URL analysis as its detection method. The rule is intended to reduce exposure to sandbox-detection evasion while alerting on potentially malicious inbound links.