Link: Suspicious URL with recipient targeting and special characters

type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(body.links,
        // special char in the path
        (
          strings.icontains(.href_url.path, '!')
          or strings.icontains(.href_url.path, '@')
        )
        // a single path
        and strings.count(.href_url.path, '/') == 2
        and (
          strings.icontains(.href_url.path, '/$')
          or strings.icontains(.href_url.path, '/*')
        )
        and (
          (
            strings.icontains(.href_url.path, recipients.to[0].email.email)
            or strings.icontains(.href_url.fragment,
                                 recipients.to[0].email.email
            )
            or any(strings.scan_base64(.href_url.path, ignore_padding=true),
                   strings.icontains(., recipients.to[0].email.email)
            )
            or any(strings.scan_base64(.href_url.fragment, ignore_padding=true),
                   strings.icontains(., recipients.to[0].email.email)
            )
          )
        )
)