This rule analyzes inbound emails for links that present as document-like file names (ending in .xlsx, .xls, .pdf, .doc, or .docx) but resolve to destinations hosted on domains registered within the last 30 days. It inspects the current email thread’s links, identifies anchors with the specified document-like display_text, resolves the final destination domain via an aggressive link analysis (ml.link_analysis(...).effective_url.domain), and then performs a Whois query to determine domain age. If the destination domain is 30 days old or newer, the rule triggers. The intent is to detect credential phishing or malware delivery infrastructure that uses freshly registered domains to harvest credentials or deliver payloads. The rule combines URL analysis, Whois-based domain age, and content inspection to reduce false positives, and is categorized as medium severity. Considerations include legitimate services with new domains or redirection patterns, which may require correlation with user context and additional reputation checks to minimize false positives.