This rule detects inbound messages that attempt to route recipients through a generic /link.html redirect path, carrying an encoded destination in the URL fragment. It first identifies links in the message body whose href path ends with /link.html and that include a non-empty fragment. It then triggers a link-analysis workflow (ml.link_analysis) for the cited URL and requires that analysis to have been submitted. The rule further demands a redirect history with more than one hop and verifies that at least one entry in the redirect chain contains a path matching the embedded fragment, indicating the final destination is the encoded target. This pattern is commonly used in bulk spam and scam lures (e.g., fake storage-deletion warnings, loan offers, discounted warranties) to obscure the true landing page behind a benign-looking tracking link. The combination of URL-chain verification and fragment matching helps distinguish genuine redirects from suspicious open-redirect abuse. Overall, the rule leverages URL analysis and content analysis to flag potential phishing or spam attempts that rely on deceptive redirects.