Detects inbound email messages where the subject contains a long hex-encoded string. The rule extracts hex substrings from the subject (subject.base) that are at least 20 hex characters long, decodes the matched hex to plaintext, and checks whether the decoded value matches any recipient address in the message (recipients.to). This targets techniques used to personalize or track bulk unsolicited messages while obscuring the payload from simple string matching. When a decoded value corresponds to a recipient, the rule triggers. This detects evasion and encoded data use in credential phishing campaigns that rely on recipient-specific data embedded in the subject. The rule combines content analysis (subject content) with header/recipient context to identify potentially targeted or stealthy phishing attempts delivered via inbound messages.