Link: Self-sender with IP geolocation check and suspicious link behavior

type.inbound
// self sender
and (
  length(recipients.to) == 1
  and recipients.to[0].email.email == sender.email.email
)
and 0 < length(body.current_thread.links) < 10
and any(filter(body.current_thread.links,
               .href_url.domain.root_domain != sender.email.domain.root_domain
        ),
        any(ml.link_analysis(.).unique_urls_accessed,
            .url == 'https://ipinfo.io/json'
        )
)
and not headers.return_path.domain.root_domain == "salesforce.com"