Detects inbound emails containing hyperlinks that use kelkoogroup.net's redirect service to send recipients to external domains outside kelkoogroup.net. It targets messages where a link's domain is kelkoogroup.net with a path including /redirect and a non-empty, decoded url parameter that points to a non-kelkoogroup.net domain. The rule excludes messages from kelkoogroup.net itself that pass DMARC, and from other highly trusted senders that pass DMARC, to reduce false positives from legitimate usage of the redirect service. It surfaces potential open redirect abuse used for phishing or spam campaigns and relies on URL analysis, header analysis, and sender analysis to classify incidents as Credential Phishing or Spam with open redirect techniques.