This rule detects inbound messages where the sender’s display name is obfuscated using Unicode format characters (character class Cf) interspersed between letters, a technique often used to evade text-based detection. It requires two signals to fire: (1) the sender.display_name must contain a pattern of letters separated by Cf characters (regex [a-z]\p{Cf}+[a-z]), indicating deliberate visual obstruction of the display name; and (2) at least one linked item in the message body must have a fragment in its href_url.fragment that is unusually long (>100 characters) and encoded in a base64url-like pattern (regex.contains(.href_url.fragment, '^[A-Za-z0-9_-]+={0,2}$')). The combination suggests an attempt to bypass URL scanners and smuggle encoded payloads toward the user, common in credential phishing campaigns that rely on social engineering to induce follow-up actions. The detection leverages URL analysis (fragment characteristics), sender analysis (obfuscated display name), and content analysis (presence and structure of links). Attack surface and intent: Credential phishing via inbound messages that masquerade as legitimate communications through decorative display names and obfuscated links. The long, base64-like URL fragments may conceal payloads, tracking parameters, or credential-harvesting destinations, making this a targeted evasion tactic rather than a broad spam indicator. False positives and considerations: Legitimate messages may occasionally use stylistic display-name obfuscation or long tracking URLs; refine with additional signals such as destination domains, host reputation, or user interactions. Consider coupling with domain reputation services, link destination validation, and post-delivery user prompts to minimize disruption while maintaining coverage for sophisticated phishing. Remediation guidance: Investigate the sender identity and the final URL destination; quarantine or block the message if the destination host is suspicious or not on allowlists; enrich with reputation checks, sandboxed URL scanning, and user education on recognizing obfuscated identifiers. Notes: Severity is medium; detections are contingent on both display-name obfuscation and long, base64-like URL fragments.