Detects inbound messages containing links where the display text starts with https:// and uses an underscore followed by 'com/' to stand in for a standard dot-com domain, aiming to bypass display-text URL parsing. The rule inspects inbound event payloads (type.inbound) for any link in the message body where display_text begins with 'https://', contains '_com/', and does not contain '.com/', and where parsing the URL from display_text yields no valid URL (strings.parse_url(.display_text).url is null). This obfuscated formatting is a known evasion technique used in credential phishing to mislead users and defeat simple URL-based checks. It is labeled as medium severity, associated with Credential Phishing, and relies on detection methods such as URL analysis and content analysis to surface potential deception. The tactic aligns with Evasion and Social Engineering. This rule is designed for telemetry from inbound messages (e.g., email, chat) traversing gateways or endpoints, focusing on display-text manipulation intended to bypass basic parsers. Potentialfalse positives may arise from legitimate branding or testing text; mitigate with host reputation checks, unmasking of final destinations, and cross-correlation with other indicators (destination domains, sender reputation) before user interaction. Operators should consider combining gateway filtering, URL unwrapping, and user education to reduce risk.