Link: Multistage landing - FreshDesk knowledge base abuse

type.inbound
and length(body.links) < 10
and any(filter(body.links,
               .href_url.domain.root_domain == "freshdesk.com"
               and strings.icontains(.href_url.path, 'support/solutions')
        ),
        // link to unknown domain on the page
        length(filter(ml.link_analysis(.).final_dom.links,
                      .href_url.domain.root_domain not in ("freshworks.com")
                      and .href_url.domain.root_domain not in $org_domains
                      and .href_url.domain.root_domain != sender.email.domain.root_domain
               )
        ) < 3
        // cred theft language on the page
        and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.display_text).intents,
                .name == "cred_theft" and .confidence != "low"
        )
)