Link: Suspicious recipient with timeout redirect

type.inbound
and (
  // self sender or invaild recipent domain or local parts match
  (
    length(recipients.to) == 1
    and (
      sender.email.email == recipients.to[0].email.email
      or recipients.to[0].email.domain.valid == false
      or sender.email.local_part == recipients.to[0].email.local_part
    )
  )
  // no recipients defined
  or (
    (
      length(recipients.to) == 0
      or all(recipients.to, .email.domain.valid == false)
    )
    and length(recipients.cc) == 0
    and length(recipients.bcc) == 0
  )
)
and 0 < length(body.current_thread.links) < 10
and any(body.current_thread.links,
        any(html.xpath(ml.link_analysis(., mode="aggressive").final_dom,
                       "//script"
            ).nodes,
            strings.istarts_with(.raw,
                                 '<script>setTimeout(function(){window.location="'
            )
            and strings.iends_with(.raw, '"+location.hash},3000)</script>')
        )
)