Link: Suspicious single-domain link with suspicious path and financial lure indicators

type.inbound
and length(distinct(body.current_thread.links, .href_url.domain.root_domain)) == 1
and any(body.current_thread.links,
        regex.contains(.href_url.path, '\/[a-z]\/[a-z0-9]{32}')
        and length(.href_url.domain.subdomain) == 3
)
and (
  any(html.xpath(body.html, '//a').nodes,
      (
        strings.icontains(.raw, "color:#4fb077")
        and strings.icontains(.display_text, 'cash offer')
      )
  )
  or (
    any(body.current_thread.links,
        strings.icontains(.display_text, 'confirm info', 'view rates')
    )
    and strings.icontains(body.html.raw, 'background-color: #007bc2')
  )
)