Detects inbound phishing messages that use CSS obfuscation to hide text in HTML emails and attachments by setting font-size or line-height with a clamp() call using a negative or zero value. The rule also requires at least one hyperlink that resolves directly to an IP address (not a domain). It targets both the live message body (body.html.raw) and email attachments parsed as RFC 822/EML to catch embedded HTML. The CSS pattern matched by the rule is a clamp() construct around font-size or line-height with a leading negative or zero value, e.g., font-size: clamp(-|0, ...). Following this, the message must contain a link whose href resolves to an IP address, enabling IP-based phishing lures. Lures span urgent account alerts, financial offers, storage login codes, service cancellations, and renewal reminders. The rule uses HTML analysis, URL analysis, and content analysis to identify suspect content and is categorized under Credential Phishing with Evasion and Social Engineering techniques.