Service abuse: Nylas tracking subdomain with suspicious content

type.inbound
and any(filter(body.current_thread.links, .href_url.domain.sld == "nylas"),
        .display_text is not null
        and strings.icontains(.href_url.domain.subdomain, 'tracking')
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)