This rule detects inbound HTML messages that use a templated, structurally patterned lure designed to resemble legitimate communications. It requires three simultaneous conditions: (1) the subject text is mirrored in the HTML body, specifically within a colored bold element identified by an XPath targeting a table cell with the style rgb(41, 88, 140); (2) the subject text is also present within a separate block that has a margin-top: 12pt style and contains inner text referencing the subject; (3) there is exactly one hyperlink (anchor tag) within the same region. When these conditions are met, the rule flags a potential credential phishing attempt that relies on social engineering and brand impersonation. This uses content and HTML structure analysis to detect templated lures and single-link calls-to-action.