Link: Multistage Landing - Abused Buildin.ai

type.inbound

// filter to just buildin.ai
and any(filter(body.links,
               (
                 .href_url.domain.root_domain == "buildin.ai"
                 and strings.icontains(.href_url.path, '/share')
               // inspect display text
               )
        ),
        any(ml.nlu_classifier(ml.link_analysis(., mode="aggressive").final_dom.display_text
            ).intents,
            .name == "cred_theft" and .confidence in ("medium", "high")
        )
)