type.inbound
// count of the lines ending with and then followed by a unicode block
and regex.count(body.html.inner_text,
'[\x{2580}-\x{259F}][^\S\r\n]*[\r\n][^\S\r\n]*[\x{2580}-\x{259F}]'
) > 10
// the total number of unicode blocks
and regex.count(body.current_thread.text, '[\x{2580}-\x{259F}]') > 150
and (
profile.by_sender_email().prevalence != "common"
or (
profile.by_sender_email().any_messages_malicious_or_spam
and not profile.by_sender_email().any_messages_benign
)
)
Playground
Test against your own EMLs or sample data.