The rule detects inbound emails that contain hyperlinks pointing to domains with suspicious top‑level domains, where the URL path ends with a single‑character HTML filename (for example, /a.html or /x.html). In addition, it requires the target domain to have been registered recently (domain age less than 30 days, as determined by WHOIS). This combination—fresh infrastructure, a short HTML entry filename, and a suspicious TLD—is commonly used by rapidly deployed phishing kits intended to harvest credentials. Implementation-wise, the rule examines the email body for links, applies a regex to identify a single-character HTML filename in the path (/[^/]\.html), checks the domain against a list of suspicious TLDs, and queries WHOIS to verify domain age. If all criteria are satisfied, the rule raises a detection with medium severity, classifying the activity under Credential Phishing and tying it to evasion and social engineering tactics. Detection methods include URL analysis and WHOIS lookup. The approach helps surface fast-moving phishing campaigns that rely on newly registered domains and simple HTML entry points, enabling faster containment and user awareness.