This rule targets inbound messages that attempt credential phishing via a fake Cloudflare verification landing page. It triggers when the email has undisclosed or empty recipients (no valid to-address or zero recipients) and no CCs, with a small set of embedded links (1–7 unique href URLs). It then analyzes the message body for an anchor in the landing page that has display_text equal to “Why am I seeing this page?” and an href that points to a self-referencing anchor (href="#"). Additionally, the rule requires evidence from link-analysis that at least one unique URL accessed by the message loads a resource from static.cloudflareinsights.com and includes a beacon script path containing “/beacon.min.js/”. The combination of a stealthy landing page, minimal link count, and loading of the Cloudflare beacon is characteristic of a phishing attempt designed to harvest credentials. Alerting on this pattern helps identify social engineering campaigns that masquerade as Cloudflare verification steps and steal user information.