Detects inbound messages that contain a hyperlink with a repeating encoded pattern in the URL path, using a ~V~ scheme followed by an allowed set of characters. The rule triggers when any link in the message body has a path containing at least three occurrences of the pattern (?:~V~[NPQRSfhjlm]+). This obfuscation technique is commonly employed to evade static URL matching and conceal the true destination. Captured samples cover a variety of lures (fake system/data access suspension notices, payment authorization failures, case submission confirmations, backup reminders), indicating a shared link-obfuscation infrastructure rather than a single brand or campaign. The emphasis on urgency and generic security themes aligns with credential phishing and spam use cases. The rule relies on inbound context and analyzes the href_url.path across links within the message body to determine matches.