This rule detects inbound email messages that attempt brand impersonation using Bluehost and aim to steal credentials. It triggers when the NLU classifier on the message body identifies an entity named sender or org containing the string 'bluehost' and detects an intent cred_theft with a non-low confidence level. To reduce false positives, it excludes messages from known Bluehost-related domains (bluehost.com, bluehost.in, newfold.com, ccsend.com) or other high-trust sender domains that pass DMARC authentication. The rule focuses on credential phishing via brand impersonation and leverages NLU, header analysis, and sender analysis to surface suspicious activity. It complements checks for DMARC/policy-based legitimacy to avoid flagging legitimate Bluehost communications or trusted senders that have DMARC passed. Attack type is Credential Phishing, with tactics including Impersonation: Brand and Social engineering. The detection methods reflect a combination of natural language understanding, header analysis, and sender analysis to correlate content, identity signals, and authentication status.