Brand impersonation: Purdue ePlanroom with suspicious links

type.inbound
and strings.icontains(body.current_thread.text, "Purdue ePlanroom")
and (
  any(filter(body.links, strings.contains(.display_text, "Review This Project")),
      .href_url.domain.root_domain != "reprographix.com"
  )
  or any(body.links, ml.link_analysis(.).credphish.disposition == "phishing")
)
and not (
  sender.email.domain.root_domain == "reprographix.com"
  and headers.auth_summary.dmarc.pass
)