Evasion: Credential phishing with newly registered domain redirecting to Wikipedia

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)
and any(body.current_thread.links,
        network.whois(.href_url.domain).days_old < 30
        and ml.link_analysis(.).effective_url.url in (
          'https://www.wikipedia.org/'
        )
)