Detects VertiStream marketing tracking links in inbound messages that have no attachments. It targets sponsor-branded content offers with no attachments, sent from bulk-registered, tech-themed compound domains, by inspecting links in the email body. The rule requires the link to be on the sender’s own domain (root domain match with the sender’s email domain) and to contain a numeric tracking path or UUID-based identifiers. Specifically, the tracking URL path must match /[0-9]+-[0-9]+/[0-9]+. The query parameters must indicate either the legacy tracking scheme with uid, prom_type, and prom_id, or the newer scheme with c and s UUIDs (each UUID pattern, 8-4-4-4-12, in lowercase hex). The detection uses URL analysis to examine href_url.path and query_params_decoded, and sender analysis to compare root domains. This combination reduces false positives from unrelated links and focuses on VertiStream’s recognizable tracking URL formats. Potential evasion includes using different domains or altering path/query formats; legitimate marketing emails that mimic VertiStream’s structure might generate false positives, and attackers could host links on non-matching domains or remove the numeric UUID patterns. Overall, the rule helps identify a specific spam pattern associated with VertiStream’s tracking links in inbound messages with no attachments, enabling prompt filtering or alerting on suspected lead-gen campaigns.