Attachment: ICS voicemail lure with suspicious link

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        and any(beta.file.parse_ics(.).events,
                // voicemail key words
                any([.summary, .description],
                    regex.icontains(.,
                                    '(?:voice\s*mail|voice\s*message|audio\s*message).{0,20}(?:notification|recording|arriv|receiv|waiting|await|pending|available|unheard|ready|logged|in\s+your|from\s+your\s+inbox)|(?:new|pending|unheard|missed|confidential)\s+(?:voice\s*mail|voice\s*message|audio\s*message)|you\s+(?:have|received)\s+a(?:\s+new\s+voice|.{0,30}voice\s*(?:mail|message))|listen\s+to\s+(?:your\s+)?voice\s*mail|listen\s+(?:to\s+)?(?:the|this|your)\s+message|message\s+to\s+listen|wireless\s*caller|audio\s*file'
                    )
                )
                // sus link
                and any(.links,
                        .href_url.domain.root_domain in $free_file_hosts
                        or .href_url.domain.domain in $free_file_hosts
                        or .href_url.domain.root_domain in $self_service_creation_platform_domains
                        or .href_url.domain.domain in $self_service_creation_platform_domains
                        or .href_url.domain.tld in $suspicious_tlds
                        or .href_url.domain.domain in $url_shorteners
                        or .href_url.domain.root_domain in $url_shorteners
                        or network.whois(.href_url.domain).days_old < 90
                        or strings.icontains(.display_url.url, "voicemail")
                        or strings.icontains(.display_text, "voicemail")
                        // minimal js landing page
                        or (
                          length(ml.link_analysis(.).unique_urls_accessed) == 3
                          and all(ml.link_analysis(.).unique_urls_accessed,
                                  .url == ..href_url.url
                                  or (
                                    strings.starts_with(.url, ..href_url.url)
                                    and strings.ends_with(.url, '.js')
                                  )
                                  or .url == strings.concat(..href_url.url,
                                                            'favicon.png'
                                  )
                          )
                        )
                )
        )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)