type.inbound
and sender.email.email == 'no-reply@wufoo.com'
and not strings.icontains(sender.display_name, 'Wufoo')
// table found in legit wufoo emails
and not length(html.xpath(body.html, "//table[@class='readonly']").nodes) == 1
and 0 < length(body.links)
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == 'cred_theft' and .confidence != 'low'
)
Playground
Test against your own EMLs or sample data.