type.inbound
and recipients.to[0].email.domain.valid
and any(html.xpath(body.html, '//a').nodes,
strings.icontains(.raw, 'direction:rtl')
and any(.links,
strings.contains(.href_url.url, recipients.to[0].email.email)
// exclude common RTL languages
and not regex.icontains(.display_text,
'[\x{0590}-\x{08FF}\x{FB1D}-\x{FDFF}\x{FE70}-\x{FEFF}]'
)
)
)
Playground
Test against your own EMLs or sample data.