Link: Scribd fullscreen link from suspicious sender

type.inbound
and length(body.links) < 10
and any(body.links,
        (
          .href_url.domain.root_domain == "scribd.com"
          or strings.icontains(.href_url.query_params, 'scribd.com')
          or strings.icontains(.href_url.query_params, 'scribd%2ecom')
          or strings.icontains(.href_url.query_params, 'scribd%252ecom')
        )
        and strings.icontains(.href_url.fragment, 'fullscreen')
)
and not profile.by_sender_email().any_messages_benign