type.inbound
and length(attachments) == 0
and 1 < length(body.links) < 5
and regex.icontains(body.current_thread.text,
'(?:\:socks5:|::127.0.0.1:1080|:0:127.0.0.1:1080)'
)
Playground
Test against your own EMLs or sample data.
type.inbound
and length(attachments) == 0
and 1 < length(body.links) < 5
and regex.icontains(body.current_thread.text,
'(?:\:socks5:|::127.0.0.1:1080|:0:127.0.0.1:1080)'
)
Test against your own EMLs or sample data.