Brand impersonation: ConstructConnect

type.inbound
// self sender or invalid recipient domain
and length(recipients.to) == 1
and (
  sender.email.email == recipients.to[0].email.email
  or recipients.to[0].email.domain.valid == false
)
and 0 < length(body.current_thread.links) < 10
and any(body.current_thread.links,
        .href_url.domain.root_domain != 'constructconnect.com'
        and any(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
                .domain.root_domain == 'constructconnect.com'
                and strings.icontains(.path, 'logo', 'favicon.ico')
        )
)