type.inbound
// Invalid reply-to address
and any(headers.reply_to, not .email.domain.valid)
and strings.icontains(subject.base, recipients.to[0].email.domain.sld)
and strings.icontains(body.current_thread.text,
recipients.to[0].email.local_part
)
and strings.icontains(body.current_thread.text,
recipients.to[0].email.domain.sld
)
and any(body.current_thread.links,
any(strings.scan_base64(.href_url.fragment),
. == recipients.to[0].email.email
)
)
Playground
Test against your own EMLs or sample data.