This rule detects inbound messages that originate from the Foxmail client and contain mismatched hyperlinks, i.e., the displayed link text does not match the actual destination URL. It evaluates inbound message data (type.inbound) and iterates over links in the current thread (body.current_thread.links) to identify a mismatched hyperlink pattern where the href_url domain's second-level domain (domain.sld) matches a short, randomized alphanumeric string ([a-z0-9]{4,7}) and the href_url path matches a short alphanumeric string within a leading slash (/ [A-Za-z0-9]{5,8}). Such short, random domains and paths are commonly associated with phishing infrastructure or URL redirection services. The rule narrows its scope to Foxmail-originated messages by checking headers.mailer for the Foxmail identifier. To reduce false positives, it excludes messages where the natural language understanding (NLU) classifier on the thread text categorizes the content as Advertising and Promotions. The rule targets Credential Phishing, leveraging a combination of URL analysis (link mismatches and pattern matching), header analysis (Foxmail indicator), and NLU to distinguish legitimate content from promotional material. Tactics and techniques include social engineering and evasion, aligning with typical phishing workflows that rely on misleading link text and non-obvious destinations.