This rule detects B2B content-syndication lead-gen spam from SenderTeam by inspecting inbound messages for tracking links embedded in the email body, with no attachments. It triggers when an inbound email has zero attachments and contains a link whose domain matches the sender’s domain. The link’s path must be one of /tr/click, /tr/unsubscribe, or /tr/bclick. The link’s query parameters must include: uid (a base58-encoded value matching [1-9A-HJ-NP-Za-km-z]+), sid (a numeric value), and type (one of c, u, or b). The detection enforces that the link’s domain aligns with the sender’s domain root, reducing spoofing risk. This pattern aligns with SenderTeam’s marking/tracking URLs used for marketing/surveys, rather than carrying attachments, and is indicative of spam or social-engineering campaigns. The rule uses URL analysis (path/query parameter extraction and validation) and sender-domain analysis to identify these messages at the network/edge level during inbound processing. The detection logic is targeted to identify specific marketing tracking behavior, rather than generic phishing, and is categorized as Spam with a medium severity due to potential annoyance or risk of credential harvesting if users click through. The primary indicators are: inbound, no attachments, tracking URL on sender’s domain, /tr/click|/tr/unsubscribe|/tr/bclick, uid base58, sid numeric, type in {c,u,b}.