Link: Apple TestFlight from suspicious sender

type.inbound
and any(body.links,
        .href_url.domain.domain in ('testflight.apple.com')
        or (
          .href_url.domain.root_domain == "mimecastprotect.com"
          and any(.href_url.query_params_decoded['domain'],
                  . in ("testflight.apple.com")
          )
        )
)
and not (
  (subject.is_forward or subject.is_reply)
  and (length(headers.references) != 0 or headers.in_reply_to is not null)
  and length(body.previous_threads) > 0
)
and (
  sender.email.domain.domain in $free_email_providers
  or beta.profile.by_reply_to().solicited == false
  or (
    beta.profile.by_reply_to().any_messages_malicious_or_spam
    and not beta.profile.by_reply_to().any_messages_benign
  )
)