This inbound rule detects phishing attempts that use visual RTL reversal to hide link text in HTML emails while the actual URL contains the target recipient’s email address. It requires a valid recipient email domain, then analyzes the HTML body to find anchor tags with direction: rtl styling. For each such anchor, it checks the href URL to see if it contains the recipient’s email address. To reduce false positives across languages, the rule excludes cases where the display text contains RTL Unicode blocks. If a matching anchor is found, the rule triggers as a Credential Phishing threat. The detection relies on HTML analysis to locate anchors and URL analysis to inspect the link targets. This pattern is commonly used for personalization in phishing campaigns to track targets or validate reachability before credential theft attempts.