Detects inbound messages containing shortened URLs that ultimately redirect to or embed content hosted on workers.dev (Cloudflare Workers). It requires a link to originate from a known URL shortener, then uses link analysis to verify the final destination or redirect history leads to workers.dev. This chain hides malicious destinations behind trusted shorteners, a technique commonly used for credential phishing infrastructure. Observed lures include fake business inquiry notices, advertising account verification alerts, and order/checkout confirmations crafted to entice clicks. The rule flags signals where the final domain or redirect history indicates workers.dev, indicating possible open redirect abuse and credential phishing infrastructure. Detection relies on URL analysis and threat intelligence to correlate shortener usage with workers.dev-hosted content. It supports defensive actions such as alerting or blocking suspect links and initiating deeper investigations into the hosting workflow to prevent credential theft and downstream credential stuffing attempts.