This rule detects inbound messages that attempt credential theft by hosting credential harvesting pages on Amazon S3 static website hosting domains (s3-website-*.amazonaws.com). It requires two conditions: (1) the message contains a link whose domain matches the S3 website host pattern, verified via a regex against href_url.domain, and (2) the message body text is analyzed by a natural language understanding (NLU) classifier that returns an intent cred_theft with high confidence. When both conditions are met, the rule triggers. The approach leverages a trusted AWS domain to evade reputation-based filters and represents credential phishing via web-hosted content. It uses URL analysis to extract and validate the domain and NLU to assess the intent behind the message. The rule is aligned with Attack Surface Reduction, targeting credential phishing tactics and social engineering, with data sources drawn from inbound message content and embedded links.