Link: Tax document lure Portuguese/Spanish with suspicious domains

type.inbound
and 0 < length(body.links) < 15
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and (
  // portuguese tax document phrases
  regex.icontains(body.current_thread.text,
                  '(?:documento fiscal|documento tributário|documento de imposto|documento de impostos|formulário fiscal|declaração de imposto|declaração de impostos|declaração fiscal|documentação fiscal|comprovante fiscal|certidão fiscal|certificado fiscal|registro fiscal|comprovativo fiscal)'
  )
  // spanish tax document phrases
  or regex.icontains(body.current_thread.text,
                     '(?:Acessar Documento|Documento Fiscal|documento tributario|documento de impuestos|comprobante fiscal|constancia fiscal|declaración de impuestos|formulario fiscal|documentación fiscal|registro fiscal|certificado fiscal)'
  )
)

// suspicious domains
and any(body.links,
        .parser == 'hyperlink'
        and (
          .href_url.domain.domain in $url_shorteners
          or .href_url.domain.root_domain in $url_shorteners
          or .href_url.domain.domain in $free_file_hosts
          or .href_url.domain.root_domain in $free_file_hosts
          or .href_url.domain.domain in $free_subdomain_hosts
          or .href_url.domain.root_domain in $free_subdomain_hosts
          or .href_url.domain.domain in $self_service_creation_platform_domains
          or .href_url.domain.root_domain in $self_service_creation_platform_domains
          or network.whois(.href_url.domain).days_old < 30
        )
        and not .href_url.domain.root_domain in ('sharepoint.com', 'box.com')
)
// subject fields
and regex.icontains(subject.base, '(?:nf|\b[0-9]{7,10}\b|nota fiscal)')

// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)