type.inbound
and strings.count(body.current_thread.text, '* * *') == 2
and strings.contains(body.current_thread.text, ': http')
and strings.contains(body.current_thread.text, '/index.php?')
and regex.icontains(body.current_thread.text,
'\* \* \*(?:[^\r\n]+|[\r\n][^\r\n]*): https?:\/\/.*\/index\.php\?[a-z0-9]+(?:[^\r\n]+|[\r\n][^\r\n]*)\* \* \*'
)
Playground
Test against your own EMLs or sample data.