Service abuse: Microsoft Forms Pro with suspicious links or QR codes

type.inbound
and sender.email.email == 'surveys@email.formspro.microsoft.com'
and (
  any(body.current_thread.links,
      (
        .href_url.domain.tld in $suspicious_tlds
        and not .href_url.domain.root_domain in ('microsoft.us')
      )
      or any(recipients.to,
             strings.icontains(..href_url.url, .email.email)
             and .email.domain.valid
      )
      or .href_url.fragment in ('[[Email]]')
      or strings.starts_with(.href_url.url,
                             'https://login.microsoftonline.com/common/oauth2/v2.0/authorize'
      )
      // personal onedrive
      or strings.starts_with(.href_url.path, '/:o:/p/')
  )
  or any(file.explode(file.message_screenshot()),
         .scan.qr.url.domain.tld in $suspicious_tlds
         or network.whois(.scan.qr.url.domain).days_old < 100
  )
)