This rule detects inbound messages whose subject header contains a structured reference-code identifier of the form #dddddddd-aaaaaaaa, where d is a digit and a is a lowercase hex digit, e.g. #12345678-abcdef12. Implemented as a header-analysis check on the inbound subject using the regex '#\d{8}-[a-f0-9]{8}\b'. The presence of such a pattern is used as a reconnaissance indicator common in social-engineering and BEC/fraud campaigns, where attackers elicit a reply to confirm mailbox liveliness and to initiate a thread for subsequent phishing steps. The alert is categorized as low severity and maps to attack types such as BEC/Fraud and Spam, with detection methods described as header analysis. Potential false positives include legitimate reference numbers, ticket IDs, or internal identifiers embedded in subjects. To reduce noise, correlate subject matches with sender reputation, DMARC/SPF/DKIM alignment, and additional message context (e.g., From vs Reply-To discrepancies, unusual domains). Recommended response paths include analyst review, quarantine, or escalation for further correlation with campaign indicators. This rule provides a lightweight signal that can be combined with broader phishing and credential-theft workflows for early-warning detection.