Link: URL shortener with copy-paste instructions and credential theft language

type.inbound
and length(body.current_thread.links) > 0
and all(body.current_thread.links,
        .href_url.domain.root_domain in $url_shorteners
)
and (
  strings.icontains(body.current_thread.text, 'copy')
  and (
    strings.icontains(body.current_thread.text, 'pasting')
    or strings.icontains(body.current_thread.text, 'paste')
  )
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence == 'high'
)
and (
  // self sender
  (
    length(recipients.to) == 1
    and sender.email.email == recipients.to[0].email.email
  )
  // or the sender is all undisclosed or there is no recipients
  or (
    length(recipients.to) == 0
    or all(recipients.to, .email.domain.valid == false)
  )
)
// negate display urls that match the sender root domain
and not any(body.current_thread.links,
            .display_url.domain.root_domain == sender.email.domain.root_domain
)