Fake Message Thread - Untrusted Sender with a Mismatched Freemail Reply-To Address

type.inbound
and (
  (
    profile.by_sender_email().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

// Reply-to is a freemail sender but From is not
and any(headers.reply_to,
        .email.domain.domain in $free_email_providers
        and not .email.domain.domain == sender.email.domain.domain
)

// Exclude marketing emails
and not strings.ilike(sender.email.local_part,
                      "support",
                      "sales",
                      "noreply",
                      "marketing"
)

// Exclude mailing lists
and not any(headers.hops,
            any(.fields,
                .name in (
                  "x-google-group-id",
                  "list-post",
                  "mailing-list"
                )
            )
)

// Check for Message Thread Indicators
and (
  regex.icontains(subject.subject, '\b(?:RE|FWD?)\s*:')
  or any([body.current_thread.text, body.html.display_text, body.plain.raw],
         3 of (
           strings.icontains(., "from:"),
           strings.icontains(., "to:"),
           strings.icontains(., "sent:"),
           strings.icontains(., "date:"),
           strings.icontains(., "cc:"),
           strings.icontains(., "subject:")
         )
  )
)

// Check for the Presence of References or In-Reply-To properties
and (length(headers.references) == 0 or headers.in_reply_to is null)