This rule detects inbound email content that references trac-link.com in two contexts: (1) links present in the email body and (2) links contained within PDF attachments. For body links, it identifies any link where the root domain is trac-link.com and the path begins with /api/mail-track/link/, signaling a potential tracker or phishing redirect. It further reduces false positives by excluding messages that traverse Easymail’s own service, specifically those whose HTML body contains storage.googleapis.com/easymails. For attachments, it targets PDFs (via file_extension or file_type) and analyzes embedded URLs inside the PDF (via file.explode and scan.pdf.urls); if any URL resolves to trac-link.com, the rule fires. Attack type associated: Credential Phishing. Tactics and techniques highlighted: Open redirect, Evasion, and PDF-related workflows. Detection methods employed: URL analysis, File analysis, and Content analysis. The rule is intended for inbound message monitoring and aims to reveal phishing campaigns that rely on trac-link.com for redirection or credential collection, either through email body links or malicious PDFs. Note potential limitations include dependence on accurate URL extraction from PDFs and the possibility of false positives if legitimate communications use trac-link.com paths; the explicit exclusion of the Easymail storage path helps mitigate some false positives but may not cover all legitimate traversal scenarios.