This rule detects inbound email messages with suspicious recipient configurations and uses aggressive link analysis to identify Gmail credential phishing kits impersonating Google’s login flow. It triggers when recipients.to contains exactly one entry and either (a) the sender and that recipient share the same email address or (b) the recipient’s domain is not valid; or when there are no valid recipients across to/cc/bcc fields (to length == 0 or all to entries have invalid domains) and there are no recipients in cc or bcc. In addition, the rule requires a small number of links in the message body (1 to 9 links in the current thread). It then analyzes each link with aggressive link analysis and checks the final rendered DOM for indicators of a Gmail credential phishing kit: a base64-encoded reference to https://gmail.com (aHR0cHM6Ly9nbWFpbC5jb20=) and the specific path /gmail/js/start.js. If both indicators appear in the final DOM, the rule raises a credential phishing alert. Attack type: Credential Phishing. Tactics/Techniques include Impersonation: Brand, Evasion, and Social engineering. Detection methods used are URL analysis, HTML analysis, and Sender analysis. This rule helps surface phishing campaigns that mimic Gmail’s login flow and direct users to credential harvesting pages.