type.inbound
and any(body.links,
.href_url.domain.root_domain == "isadatalab.com"
and strings.icontains(.href_url.path, '/redirect')
and regex.icontains(.href_url.query_params, '(?:^|&)url=')
)
and sender.email.domain.root_domain != 'bestdeals.today'
and headers.return_path.domain.root_domain != "bestdeals.today"
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Playground
Test against your own EMLs or sample data.