type.inbound
and sender.email.domain.root_domain == "zohodesk.com"
and any(headers.reply_to, .email.domain.root_domain != "zohodesk.com")
and (
any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "job_scam" and .confidence != "low"
)
// nlu fallback where we don't get job scam
or strings.icontains(body.current_thread.text, "talent acquisition")
)
Playground
Test against your own EMLs or sample data.