This rule detects inbound messages that contain a URL linking to a Dropbox Paper document, specifically URLs under the /scl/fi/ sharing path with a .paper extension and a rlkey query parameter. The detection triggers when any link within the current thread satisfies: the domain is dropbox.com (root_domain), the path begins with /scl/fi/, the file extension is .paper, and the query parameters decoded include rlkey. This pattern is commonly abused to host phishing content or malicious redirects on a trusted domain, allowing messages to bypass reputation-based filtering and lure recipients into opening a shared Paper document. The rule is designed for URL analysis of inbound communications and targets credential phishing scenarios that leverage Dropbox Paper as a lure.