Technical summary: This rule detects inbound messages from a sender with local-part 'support' in combination with a domain registered within the last 30 days. It leverages WHOIS data to determine domain age (days_old < 30), and inspects the message body for links whose href URL path contains '.mp4/views/', indicating a video-like resource. The detection also requires the sender's local-part to be 'support', aligning with common social-engineering phishing campaigns that impersonate support teams. The rule uses Whois lookups, URL/path analysis, and sender analysis to flag likely malicious activity. It is categorized under Malware/Ransomware with a social-engineering tactic and uses detection methods such as Whois, URL analysis, and Sender analysis. Recommended actions include filtering or blocking such messages, validating newly registered domains, and user education to avoid clicking unfamiliar video links from suspicious domains.