Link: Gmail confidential mode message with suspicious recipient patterns

type.inbound
and any(body.current_thread.links,
        .href_url.domain.domain == "confidential-mail.google.com"
        and strings.istarts_with(.href_url.path, "/msg/")
)
and (
  // self sender
  (
    length(recipients.to) == 1
    and recipients.to[0].email.email == sender.email.email
  )
  // no valid recipients at all
  or (
    length(filter(recipients.to, .email.domain.valid)) == 0
    and not length(filter(recipients.cc, .email.domain.valid)) == 1
  )
)