Detects messages that appear to originate from Adobe's messaging infrastructure (sender.message@adobe.com) containing mailto links that point to domains registered within the last 365 days. The rule targets inbound messages (type.inbound) and requires the sender to be message@adobe.com. It then inspects body.links for any link with href_url.scheme equal to mailto. For each such link, it performs a Whois/age check on the linked domain (network.whois(.href_url.domain).days_old) and triggers if the domain age is under 365 days. This combination aims to surface credential phishing attempts and social engineering that abuse lookalike or freshly registered domains. Detection methods include Sender analysis, Header analysis, URL analysis, and Whois lookups. The rule is categorized under Attack surface reduction and leverages Adobe-centric abuse signals to catch misused messaging channels that could bypass conventional filtering by using newly minted domains in mailto links. While effective against rapid-domain phishing setups, the rule may generate false positives if legitimate Adobe campaigns use new domains, or if Whois data is incomplete or delayed. It is best used alongside other controls (e.g., DMARC, SPF, DKIM, and broader URL/content analysis) to corroborate alerts.