Service abuse: Cognito Forms with short body from unknown sender

type.inbound
and regex.count(body.html.raw,
                '(?:<(?:p|div)[^>]*>\s*<br>\s*</(?:p|div)>\s*){6,}'
) >= 1
and sender.email.domain.root_domain != "cognitoforms.com"
and any(body.current_thread.links,
        .href_url.domain.root_domain == "cognitoforms.com"
        and length(.display_text) > 8
        // negating benign hits
        and not .display_text =~ "opt-out"
        and not strings.icontains(.display_text, "cognitoforms.com")
)
// negating messages which use cognito and other mailing platforms
and not any(body.current_thread.links, .display_text =~ "unsubscribe")