Detects inbound emails containing a link whose URL fragment hex-encodes the recipient's email address. The rule decodes the fragment from .href_url.fragment and compares it to recipients.to[0].email.email, triggering when there is a match. This pattern is used to pre-fill or validate a credential‑harvesting page (e.g., fake password expiry or account notices) to increase credibility and lure the user into a login page. The detection relies on URL analysis and content inspection of email bodies, aiming to identify social engineering attempts that leverage obfuscated fragments to tailor phishing pages to the target. It is a heuristic signal and should be combined with other checks (domain reputation, page content, user context) for lower false positives. Remediation involves alerting or filtering the message, blocking the link, and user training to recognize credential‑phishing cues. Limitations include reliance on the first recipient matching, potential misses in multi‑recipient scenarios, and possible false positives if legitimate links legitimately hex-encode data in fragments or if different encoding schemes are used.