type.inbound
// Legitimate zoom sending infrastructure
and sender.email.email == "no-reply@zoom.us"
// sharing a clip
and strings.starts_with(subject.base, 'Clips')
// reply-to domain is not registered
and (network.whois(headers.reply_to[0].email.domain).found == false)
Playground
Test against your own EMLs or sample data.