Link: Self-sent PDF lure with subject correlation

type.inbound
// self sender
and (
  length(recipients.to) == 1
  and recipients.to[0].email.email == sender.email.email
)
// bold a tags ending in PDF
and any(html.xpath(body.html, '//a[./b]').nodes,
        strings.iends_with(.display_text, ".pdf")
        and (
          // subject appears as the .pdf link
          any(regex.extract(subject.base, '(?P<word>\w+)'),
              strings.contains(..display_text, .named_groups["word"])
          )
          // OR sender domain appears as the pdf link
          or strings.icontains(.display_text, sender.email.domain.sld)
        )
        // we should NOT match urls
        and strings.parse_url(.display_text, strict=false).url is null
        and not any(.links, strings.iends_with(.href_url.path, '.pdf'))
)