Link: Suspicious file retrieval with recipient targeting

type.inbound
and any(body.links,
        // observed url path
        strings.icontains(.href_url.path, '/getfile/filefor')
        // with email
        and strings.icontains(.href_url.path, recipients.to[0].email.email)
)