This rule detects inbound plain-text email messages that contain a URL and are structured as a forwarded message, with no prior thread history and no HTML body. It triggers when the message body is plain text (no body.html.raw), there are zero previous_threads, and the current_thread.text contains a URL (http/https). The preamble must either start with Begin forwarded message: or include a From line that corresponds to the sender’s display name within a forwarded message structure. This pattern can indicate attempts to disguise origin or deliver malicious links via forwarded formatting, a common tactic in credential phishing and BEC/fraud. Detection relies on content analysis (message text and URL presence), sender analysis (matching the preamble’s From/sender name), and URL analysis to surface potentially malicious links.