type.inbound
and any(body.links,
.href_url.domain.root_domain == "googleweblight.com"
and regex.match(.href_url.query_params, "(lite_url|u)=.*")
)
and (
not profile.by_sender().solicited
or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign
Playground
Test against your own EMLs or sample data.