Link: Google Calendar invite linking to an open redirect from an untrusted freemail sender

type.inbound
and strings.iends_with(subject.subject, "has shared a calendar with you")
and strings.ilike(headers.message_id, "<calendar*@google.com>")
and sender.email.domain.domain in $free_email_providers
and any(body.links,
        any(.href_url.rewrite.encoders, strings.icontains(., "open_redirect"))
        or (
          any(ml.link_analysis(.).final_dom.links,
              any(.href_url.rewrite.encoders,
                  strings.icontains(., "open_redirect")
              )
          )
        )
)
and profile.by_sender().prevalence in ("new", "outlier")
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)