A rule that detects inbound emails containing links to pixel.sitescout.com /iap/ tracking pixel endpoints with a populated r query parameter, indicating an open redirect used to disguise malicious destinations. It matches if any link in the email body has href_url.domain.domain == "pixel.sitescout.com" and the path starts with "/iap/" and the decoded query parameter 'r' length is > 0. To reduce false positives, messages from highly trusted sender domains are excluded when DMARC authentication passes; i.e., the rule negates if the sender's root domain is in the high-trust set and headers.auth_summary.dmarc.pass is true. The rule is categorized under potential Credential Phishing and Spam, and uses URL analysis, header analysis (DMARC), and sender analysis. It targets open redirect abuse as an evasion technique by phishers. Evasion risks include altering the endpoint, encoding variations, or DMARC failures on trusted domains; legitimate uses of the tracking pixel may also trigger when not carefully whitelisted. For context, this rule should be integrated with additional signals to strengthen phishing detection. Data sources point to network activity and domain name evaluation, while the domain coverage reflects web-related content and a general, catch-all category. Keywords include open redirect, Sitescout, tracking pixel, DMARC, and phishing to aid triage and correlation.