Link: WordPress admin targeting with recipient identifier in URL fragment

type.inbound
and any(body.links,
        regex.icontains(.href_url.path,
                        '^\/(?:wp-(?:admin|includes|content|login|json|signup|activate|cron|mail)|xmlrpc\.php)'
        )
        // base64 encoded
        and (
          any(strings.scan_base64(.href_url.fragment),
              strings.icontains(., recipients.to[0].email.email)
          )
          // not base64
          or strings.icontains(.href_url.fragment, recipients.to[0].email.email)
        )
)