This rule detects inbound emails that are likely targeted credential phishing attempts leveraging JavaScript-driven redirection to evade automated link inspection. It focuses on messages sent to self, to invalid/ undisclosed recipients, or to empty recipient fields, where the email body contains a small set of links (1–9). It analyzes the linked content for a specific obfuscated redirection pattern: a script containing a setTimeout that redirects the browser to a URL using location.hash after a 3-second delay. The detection combines recipient validation, link quantity, and script/HTML analysis (including aggressive link-analysis and DOM inspection) to identify attempts that delay and camouflage the final destination URL. When matched, the rule is categorized under Credential Phishing and associates with scripting, evasion, and social engineering techniques, using URL, JavaScript, HTML, and sender analyses to corroborate the threat.