This rule detects inbound emails that carry an RTF attachment and processes embedded content to identify URL destinations. It extracts URLs from the RTF, follows redirects to the final destination, and analyzes the final page’s links. If any linked resources resolve to domains hosted on Cloudflare Pages (pages.dev), the rule flags the event as a potential credential phishing attempt. The detection combines file analysis (RTF attachment parsing), URL analysis (redirect tracking), HTML analysis (final page link inspection), and sender analysis to assess legitimacy. The rule is rated high severity due to the potential to harvest credentials or deceive recipients by leveraging free hosting subdomains. It helps reduce phishing risk by surfacing or blocking messages that direct users to deceptive, cloud-hosted destinations via free pages.dev domains.