type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == 'cred_theft' and .confidence != 'low'
)
and any(body.current_thread.links,
.href_url.domain.root_domain == 'trycloudflare.com'
and strings.icontains(.href_url.path, recipients.to[0].email.email)
)
Playground
Test against your own EMLs or sample data.