This rule detects inbound HTML content that uses a CSS calc() expression subtracting identical numeric values with the same unit, e.g., calc(100px - 100px). Such expressions resolve to zero and are commonly used to hide or collapse content within the DOM while keeping it present in the HTML. This obfuscation technique is frequently leveraged to evade text-based detection or conceal potentially malicious content from recipients in phishing or spam campaigns. The rule extracts the numeric parts and units from the calc() expression and enforces that both sides are equal (n1 == n2 and u1 == u2). It relies on HTML content analysis of inbound messages and triggers when the pattern is found, indicating potential evasion or obfuscation activity aimed at hiding payloads.