Flags inbound emails where the sender's display name contains a space and the HTML body contains a styled table cell with a linked button whose title attribute reveals a leftover Shopify CDN file path, but the button's actual href does not point to that same path on cdn.shopify.com. This mismatch suggests a hijacked or repurposed Shopify email template being used to redirect recipients to an unintended destination. Messages from highly trusted sender domains that pass DMARC authentication are excluded. The rule uses HTML analysis to locate the relevant button, a regex to extract the potential Shopify path from the title attribute, and a comparison against the actual href URLs to detect a path mismatch. It is categorized under credential phishing and relies on evasion and social engineering techniques to lure recipients into clicking deceptive links while attempting to bypass trusted senders with DMARC.)