Detects inbound messages from free email providers that use heavy obfuscation via zero-width no-break space (FEFF) characters inserted before closing HTML tags, a technique intended to defeat content scanners. The rule requires four conditions: (1) inbound email flow, (2) the sender’s root domain is in a configured $free_email_providers list, (3) at least 20 matches of a FEFF-based obfuscation pattern in the HTML body (regex.icount on body.html.raw), and (4) a phone-number pattern present in the message thread (regex.icontains on body.current_thread.text) using coupled patterns to accommodate common formats. When all are met, the event is flagged as Callback Phishing. It combines HTML analysis (to detect obfuscated markup), content analysis (to verify phone-number presence in the thread), and sender analysis (to confirm free-provider origin). Attacker techniques include evasion of scanners and social engineering to prompt phone-based contact, aligning with callback phishing. Data sources include inbound message content captured in application logs or mail processing pipelines. Potential limitations include false positives from legitimate campaigns that unintentionally use obfuscation or phone references, false negatives if attackers vary the obfuscation technique or if HTML normalization masks the signals, and dependency on the completeness of the inbound content data and the accuracy of the free-provider list. Operators should validate with mail gateway logs and consider corroborating indicators (e.g., suspicious attachments, ignored links) before triaging as phishing.