This inbound email rule flags messages whose subject is exactly the sender's domain SLD (subject.base =~ sender.email.domain.sld) and that meet one of two recipient-state conditions: (1) a single To recipient where the address matches the sender or the recipient domain is invalid or the local parts are identical, or (2) no recipients defined (To empty or all To recipients have invalid domains and CC/BCC are empty). In addition, the message must contain at least one link in the body whose root domain is in either a known free file hosting list ($free_file_hosts) or a known free subdomain hosting list ($free_subdomain_hosts). This combination—self-referential subject, anomalous recipient state, and links to free hosting domains—is characteristic of credential phishing campaigns that leverage self-sent notifications and external hosting to disguise malicious links. The rule is categorized under Credential Phishing and employs multiple detection techniques: URL analysis (root-domain membership in free-host lists), Header analysis (subject and sender), Sender analysis (comparison of sender vs. recipient fields), and Content analysis (inspection of body links). Overall, it aims to identify phishing attempts that exploit self-addressed scenarios and hosted links, which are commonly used to harvest credentials. Potential false positives may occur with legitimate automated notifications or internal systems that use a sender/domain-matching subject pattern or host benign links; tuning lists of free hosting domains and adapting recipient criteria may help reduce noise. The rule emphasizes a holistic check across headers, sender/recipient relations, and link content to improve precision in inbound detection.