This rule detects inbound emails from recently established sender domains (days_known < 7) that contain links which ultimately redirect through a .su (Soviet Union) top-level domain. It targets messages where the visible link is not a .su domain but the link analysis reveals a redirect_history containing a .su domain, indicating the use of open redirect infrastructure to obscure the final destination. The intent is typically phishing or credential theft, with attackers leveraging legitimate-looking senders (e.g., academic transcripts, invitations, or administrative notices) to lure recipients into following the link. The detection combines URL analysis of embedded links with sender-domain history to identify high-risk redirection chains, enabling prioritization of new-sender phishing campaigns that rely on .su infrastructure to evade early filtering.