Service abuse: AppSheet infrastructure with suspicious indicators

type.inbound
and sender.email.email == "noreply@appsheet.com"
and (
  // recently registered or suspicious links
  (
    any(filter(body.links, .href_url.domain.root_domain != "appsheet.com"),
        network.whois(.href_url.domain).days_old <= 10
        or .href_url.domain.root_domain in $free_file_hosts
        or .href_url.domain.domain in $free_subdomain_hosts
        or .href_url.domain.root_domain in $url_shorteners
        // account for URL rewrites
        or (
          any(.href_url.query_params_decoded['domain'],
              (
                . in $url_shorteners
                or . in $free_subdomain_hosts
                or . in $free_file_hosts
              )
          )
        )
    )
  )
  // suspicious display name
  or (
    regex.icontains(sender.display_name,
                    '(?:legal|misuse|compliance|violation|enforcement)',
                    // unicode blank character confusables in display name
                    '\x{00A0}|\x{1680}|\x{2000}|\x{200A}|\x{200B}|\x{202F}|\x{205F}|\x{3000}'
    )
    // commonly impersonated brands
    or strings.ilike(strings.replace_confusables(sender.display_name),
                     '*Apple*',
                     '*Amazon*',
                     '*Binance*',
                     '*Facebook*',
                     '*Meta*',
                     '*Google*',
                     '*LinkedIn*'
    )
  )
  // suspicious pattern in body
  or regex.icontains(body.current_thread.text,
                     '(?:(Copyright|Advertising|Content|Data|Intellectual Property|I\.?\s?P\.?\b) (?:Polic(y|ies))|Violation|Contravention|Complaint|Misuse)|(?:(Enforce(ment)?|Required|Mandatory|Immediate) (?:Action|Response))|Cease (\&|and) Desist'
  )
  // NLU failsafe
  or (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in~ ("cred_theft", "steal_pii", "job_scam")
        and .confidence in~ ("medium", "high")
    )
    // negate the NLU result if there is only a single link leading back to AppSheet (likely benign)
    and not (
      length(body.links) == 1
      and any(body.links,
              .display_text == "Powered by AppSheet"
              and .href_url.domain.root_domain == "appsheet.com"
      )
    )
  )
)
// negate legitimate use of AppSheet within the org
and not (
  length(headers.reply_to) is not null
  and any(filter(headers.reply_to, .email.domain.root_domain != "appsheet.com"),
          .email.domain.root_domain in~ $org_domains
          or .email.domain.root_domain in~ $recipient_domains
  )
)