Link: JavaScript obfuscation with Telegram bot integration

type.inbound
and 0 < length(body.links) < 15
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(body.links,
        // javascript obfuscator code - https://obfuscator.io/
        regex.icontains(ml.link_analysis(.).final_dom.raw,
                        '(?:(?:return|function|var|let|const|parseInt)\(?\s*_0x[a-f0-9]{6}.{0,50}){5}'
        )
        and regex.icontains(ml.link_analysis(.).final_dom.raw,
                            // telegram bot token struct
                            '[\x22\x27][0-9]{10}:[a-z0-9_-]{20,35}[\x22\x27]',
                            // telegram strings
                            '(?:telegram(?:chatid|BotToken)|TELEGRAM_(?:BOT_TOKENS|CHAT_IDS)|api\.telegram\.org/bot|telegramToken)'
        )
)