Fake shipping notification with suspicious language

type.inbound
// contains at least 1 link
and length(body.links) > 0
and 3 of (
  strings.ilike(body.current_thread.text, "*(1)*"),
  strings.ilike(body.current_thread.text, "*waiting for delivery*"),
  strings.ilike(body.current_thread.text, "*delivery missed*"),
  strings.ilike(body.current_thread.text, "*tracking number*")
)

// urgent/time-sensitive language
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "urgency"
)

// email is not personalized with recipients name
and any(recipients.to,
        any(ml.nlu_classifier(body.current_thread.text).entities,
            .text == ..email.local_part
        )
)