Self-impersonation: Sender matches recipient with bolded name and suspicious link

type.inbound
// sender matches recipients
and (
  length(recipients.to) == 1
  and recipients.to[0].email.email == sender.email.email
)
// sender in current thread BOLD
and any(html.xpath(body.html, '//b').nodes,
        .display_text == sender.display_name
)
// we want the dashed html element to contain a link, and that link to include part of the subject (the subject is the org)
and any(html.xpath(body.html,
                   '//table//td[contains(@style, "border-style: dashed") and contains(@style, "border-width: 1pt")]//a[./b]'
        ).nodes,
        any(regex.extract(subject.base, '(?P<word>\w+)'),
            any(..links,
                strings.icontains(.href_url.url, ..named_groups["word"])
            )
        )
)