Detects inbound messages containing a link hosted on appspot.com (specifically a subdomain ending with .r.appspot.com) with credential theft intent identified in the message body. The rule checks body.current_thread.links for any URL whose domain ends with .r.appspot.com and uses ml.nlu_classifier(body.current_thread.text).intents to confirm an intent named cred_theft. It then excludes highly trusted senders if DMARC authentication passes; if a trusted sender fails DMARC or is not in the high-trust set, the detection fires. This combination reduces false positives from trusted domains while targeting credential-phishing attempts that rely on Google App Engine hosting. The rule maps to Credential Phishing, with tactics including Free subdomain host and Social engineering. Detection methods include URL analysis (host/domain evaluation), Natural Language Understanding (intent classification), and Header analysis (DMARC status). Overall, it is designed to flag inbound email-based credential phishing that uses appspot-hosted links to lure users into credential entry.