Service abuse: FlipHTML5 with attachment deception and credential theft language

type.inbound
// messages contain wording to "see attached" but contains no attachments
and (
  regex.icontains(body.current_thread.text,
                  "attached|see.*attached|find.*attached|please{0,10}attached"
  )
  and length(attachments) == 0
)
// and the link goes to fliphtml5 and contains suspect "click me" language
and any(body.links,
        .href_url.domain.root_domain == "fliphtml5.com"
)
// and we have confidence its cred theft
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)