Attachment: Small text file with link containing recipient email address

type.inbound
and any(attachments,
        .content_type in~ ("text/plain", "text")
        // negate calendar invites
        and not (
          .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        and any(file.explode(.),
                .size < 1000
                and any(.scan.url.urls,
                        any(recipients.to,
                            strings.icontains(..url, .email.email)
                            and .email.domain.valid
                        )
                )
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)