Link: Credential theft via newly registered suspicious domain in query parameter

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)
and any(filter(body.current_thread.links, .href_url.scheme != 'mailto'),
        any(flatten(values(.href_url.query_params_decoded)),
            strings.parse_url(.).domain.valid
            and strings.parse_url(.).domain.tld in $suspicious_tlds
            and network.whois(strings.parse_url(.).domain).days_old < 30
        )
)
and not (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    or sender.email.domain.root_domain in ("supabase.io")
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)