type.inbound
and (
any(html.xpath(body.html, '//h3').nodes,
.inner_text == "Webmail HostingServer"
)
or (
any(body.links,
.display_url.url == "support@webmail.com"
and .href_url.url == "support@webmail.com"
)
)
)
Playground
Test against your own EMLs or sample data.