Free subdomain link with credential theft indicators

type.inbound
and any(body.links,
        .href_url.domain.root_domain in $free_subdomain_hosts
        and .href_url.domain.subdomain is not null
        and .href_url.domain.subdomain != "www"
)
and (
  (
    (
      length(recipients.to) == 0
      or all(recipients.to, .display_name == "Undisclosed recipients")
    )
    and length(recipients.cc) == 0
    and length(recipients.bcc) == 0
  )
  or (
    length(recipients.to) == 1
    and any(recipients.to, .email.email == sender.email.email)
  )
  or (
    length(recipients.to) == 0
    and length(recipients.cc) == 0
    and length(recipients.bcc) > 0
  )
)
and any(body.links,
        any(file.explode(ml.link_analysis(.).screenshot),
            any(ml.nlu_classifier(.scan.ocr.raw).intents,
                .name == "cred_theft" and .confidence != "low"
            )
        )
)