This rule detects inbound emails that are classified as credential theft with at least medium confidence and that contain a linked page whose final DOM includes a script designed to track or beacon a visitor. Specifically, it looks for a unique visitor token generated by concatenating Date.now() converted to base 36 with Math.random() converted to base 36, then using that token to beacon back through a dynamically created Image object. The beacon pattern requires the script to create a new Image and assign a src, a common behavior for link-click or visit tracking in credential phishing infrastructure. The detection leverages aggressive link analysis to examine the final DOM of linked pages, and uses natural language understanding to confirm credential-theft intent alongside HTML/JavaScript analysis to identify the beacon script pattern.