Link: Suspicious TLD hosting client.js with cf beacon

type.inbound
and (
  any(recipients.to, .email.domain.valid == false) or length(recipients.to) == 0
)
and length(recipients.cc) == 0
and 0 < length(body.links) < 8
and sender.email.domain.tld not in $suspicious_tlds
and any(body.links,
        not .display_text is null
        and ml.link_analysis(.).effective_url.domain.tld in $suspicious_tlds
        and any(ml.link_analysis(.).unique_urls_accessed,
                // client.js hosted on the suspect domain
                .domain.domain == ml.link_analysis(..).effective_url.domain.domain
                and .path == "/client.js"
        )
        and any(ml.link_analysis(.).unique_urls_accessed,
                .domain.domain == "static.cloudflareinsights.com"
                and strings.contains(.path, "/beacon.min.js/")
        )
)