Low Severity
Link: Invoice or receipt from freemail sender with customer service number
Description
An email from a freemail sender which instructs the recipient to call a fraudulent customer service number.
References
No references.
type.inbound
and sender.email.domain.root_domain in $free_email_providers
and any(body.links,
.display_text == "Unsubscribe"
and (length(.href_url.query_params) == 0 or .href_url.query_params is null)
and (
.href_url.path == "/"
or .href_url.path is null
or (
.href_url.domain.root_domain == "google.com"
and not strings.ilike(.href_url.path, "*/forms/*")
)
)
)
and sender.email.email not in $sender_emails
Playground
Test against your own EMLs or sample data.