type.inbound
and any(body.links,
"google_translate_open_redirect" in .href_url.rewrite.encoders
)
and (
not profile.by_sender().solicited
or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign
Playground
Test against your own EMLs or sample data.