Link: Self-sender credential theft with configuration placeholder

type.inbound
// self sender
and length(recipients.to) == 1
and sender.email.email == recipients.to[0].email.email
and any(body.current_thread.links,
        strings.contains(ml.link_analysis(., mode="aggressive").final_dom.raw,
                         '/*──── CONFIG: Replace with your lure URL ────*/'
        )
)