Spam: Personalized subject and greetings via Salesforce Marketing Cloud

type.inbound
// attempt to find SF sending infra
and (
  headers.domains[0].root_domain in ("exacttarget.com", "pd25.com")
  or strings.iends_with(headers.message_id, '.xt.local>')
  or any(headers.hops,
         any(.fields,
             .name =~ "X-SFMC-Stack"
             or (.name =~ "x-job" and regex.match(.value, '^\d+_\d+$'))
         )
  )
)
// the message contains a fake previous thread
and length(body.previous_threads) == 1

// extract the name from the subject
and any(regex.iextract(subject.base,
                       '(?:^|: )(?P<first_name>[A-Z][a-z]+)(?:$| \|)'
        ),
        // the current thread starts with "Hi <extracted from subject>
        strings.istarts_with(body.current_thread.text,
                             strings.concat('Hi ', .named_groups["first_name"])
        )
        // strip nlu greeting + first name
        or any(ml.nlu_classifier(body.current_thread.text).entities,
               .name == "greeting"
               and strings.istarts_with(body.current_thread.text,
                                        strings.concat(.text,
                                                       ' ',
                                                       ..named_groups["first_name"]
                                        )
               )
        )
        // the previous thread starts with "Hi <extracted from subject>
        or any(body.previous_threads,
               strings.istarts_with(.text,
                                    strings.concat('Hi ',
                                                   ..named_groups["first_name"]
                                    )
               )
               // strip nlu greeting + first name
               or any(ml.nlu_classifier(.text).entities,
                      .name == "greeting"
                      and strings.istarts_with(..text,
                                               strings.concat(.text,
                                                              ' ',
                                                              ...named_groups["first_name"]
                                               )
                      )
               )
        )
)