Link: Hex-encoded recipient email in URL fragment

Detects messages where a link in the body contains the recipient's email address hex-encoded in the URL fragment, a technique used to auto-populate or validate the target on a credential harvesting page. This pattern commonly appears in fake password expiration or account notice lures that direct victims to spoofed login pages pre-filled with their own address to increase credibility.