type.inbound
and any(filter(body.current_thread.links,
.href_url.domain.root_domain == 'eventcreate.com'
),
any(ml.link_analysis(.).final_dom.links,
network.whois(.href_url.domain).days_old < 30
)
or ml.link_analysis(.).credphish.disposition == "phishing"
)
Playground
Test against your own EMLs or sample data.