This inbound rule detects HTML inbound content that contains affiliate-tracking links. It analyzes links present in the body (body.links) and evaluates two patterns related to an affiliate token embedded in URLs. Pattern A checks the hyperlink path: if href_url.path ends with .home.php and the decoded query parameters contain both sq and lk keys, indicating an affiliate query string. Pattern B checks the URL fragment: if the fragment contains .home.php?sq= and also contains &lk, implying the same tracking token within the fragment. If either pattern is matched, the rule triggers. The detection method used is URL analysis. The rule is categorized as Spam and leverages techniques such as using affiliate tracking (often associated with free file hosts) and evasion of basic filter checks. Observed context notes mention usage in health, reward, and account suspension spam campaigns, where attackers embed affiliate tokens to monetize user interactions. This rule focuses on inbound content, flagging suspicious affiliate-tracking patterns before user interaction with the destination site. False positives may occur with legitimate marketing campaigns that legitimately utilize similar query parameters, so corroborating signals (e.g., domain reputation, sender context) should be considered for remediation decisions.