Link: Credential phishing via WordPress

type.inbound
and sender.email.domain.root_domain != "wordpress.com"
// there are few links
and 0 < length(body.links) <= 5
// there are wordpress links
and any(body.links,
        .href_url.domain.root_domain == "wordpress.com"
        and .href_url.domain.domain != "wordpress.com"
)
// a single link to wordpress site
and length(filter(body.links,
                  .href_url.domain.root_domain == "wordpress.com"
                  and .href_url.domain.domain != "wordpress.com"
           )
) == 1

// not a reply
and length(headers.references) == 0
and headers.in_reply_to is null

// we detect the wordpress page has phishing
and any(filter(body.links, .href_url.domain.root_domain == "wordpress.com"),
        ml.link_analysis(.).credphish.disposition == "phishing"
        or strings.icontains(ml.link_analysis(.).final_dom.display_text,
                             'This blog has been archived or suspended in accordance with our Terms of Service'
        )
)