type.inbound
// from Adobe
and sender.email.email == 'message@adobe.com'
// sender has a recently created email domain
and any(filter(body.links, .href_url.scheme == 'mailto'),
network.whois(.href_url.domain).days_old < 365
)
Playground
Test against your own EMLs or sample data.