type.inbound
and any(regex.iextract(subject.subject,
'[^a-z0-9](?P<string>[a-z0-9]{32,64})(?:$|[^a-z0-9])'
),
any(body.links,
strings.contains(.href_url.fragment, ..named_groups["string"])
and any(strings.scan_base64(.href_url.fragment), strings.contains(., recipients.to[0].email.email))
)
)
Playground
Test against your own EMLs or sample data.