type.inbound
and any(body.links,
(
strings.iends_with(.href_url.path, '.home.php')
and all(["sq", "lk"], . in keys(..href_url.query_params_decoded))
)
or (
strings.icontains(.href_url.fragment, '.home.php?sq=')
and strings.icontains(.href_url.fragment, '&lk')
)
)
Playground
Test against your own EMLs or sample data.