Detects inbound emails spoofing Target's domain (orders@oe1.target.com) that contain a shipping-address block with suspiciously formatted ZIP and phone numbers, indicating a credential phishing/callback scam lure. The rule analyzes the email HTML body to locate the shipping-address block via XPath (//h1[contains(@class,"ship-address")]/span) and then applies multiple regex patterns to identify ZIP-like formats and phone-number patterns. A match triggers a detection of Credential Phishing and Spam, with associated tactics of impersonation (brand), evasion, spoofing, and social engineering. Detection methods include HTML analysis, content analysis, and sender analysis, aligning with brand impersonation and phishing techniques used in social-engineered outreach.