type.inbound
and length(body.previous_threads) == 0
and any(ml.nlu_classifier(body.current_thread.text).topics,
.name in ("Romance", "Sexually Explicit Messages")
and .confidence == "high"
)
and 1 of (
any(body.links, network.whois(.href_url.domain).days_old < 30),
any(body.links, .href_url.domain.root_domain in $url_shorteners),
any(headers.reply_to, network.whois(.email.domain).days_old < 30)
)
and 0 < length(distinct(body.links,
.href_url.domain.root_domain not in ("aka.ms")
)
) < 3
and all(body.links,
.href_url.domain.root_domain != sender.email.domain.root_domain
)
Playground
Test against your own EMLs or sample data.