The rule detects inbound email traffic that attempts credential phishing via a small set of links (1–7) and leverages a self-hosted client.js file on a suspicious TLD, coupled with a Cloudflare beacon. It requires: (1) inbound messages with either no recipients or at least one invalid recipient in the To field, no CCs, and a limited number of links (0 < length(body.links) < 8); (2) the sender’s domain TLD not in a known suspicious list; (3) at least one link with a non-null display_text whose analyzed URL resolves to a suspicious TLD, and where a unique URL accessed includes a client.js path hosted on the suspect domain; and (4) the presence of a Cloudflare beacon beacon.min.js request from static.cloudflareinsights.com among the accessed URLs. The rule maps to Credential Phishing with Social Engineering and Scripting techniques, using URL analysis, content analysis, and sender analysis to detect suspicious link behavior and loading of a malicious script. Potential positives include targeted phishing campaigns that rely on self-hosted client.js and external beacons; potential false positives may occur with legitimate marketing emails containing external scripts or beacons. Detection should be complemented with domain reputation checks and recipient validation on the mail gateway and network security controls that block unexpected external script loads.