type.inbound
and (
any(recipients.to, .email.domain.valid == false) or length(recipients.to) == 0
)
and length(recipients.cc) == 0
and 0 < length(distinct(body.links, .href_url.url)) < 8
and any(body.links,
any(html.xpath(ml.link_analysis(.).final_dom, '//a').nodes,
.display_text == "Why am I seeing this page?"
and strings.contains(.raw, 'href="#"')
)
and any(ml.link_analysis(.).unique_urls_accessed,
.domain.domain == "static.cloudflareinsights.com"
and strings.contains(.path, "/beacon.min.js/")
)
)
Playground
Test against your own EMLs or sample data.