Zoom Events newsletter abuse

type.inbound
and sender.email.email == "noreply-zoomevents@zoom.us"
and (
  headers.auth_summary.spf.pass
  or headers.auth_summary.dmarc.pass
)

// extract the actor controlled message from the email body
and any(html.xpath(body.html,
                   "//div[@class='eb-content css-1l7xmti']//td[@data-dynamic-style-background-color='email.bodyColor.color' and @style='border-radius: 8px; background-color: rgb(255, 255, 255);']"
        ).nodes,
        // look at the content before the copyright footer in the template and pass it to NLU to see if it's cred theft 
        any(html.xpath(.,
                       "//td[@data-dynamic-style-background-color='email.bodyColor.color']/*[position() < last()]"
            ).nodes,
            any(ml.nlu_classifier(..display_text).intents,
                .name == "cred_theft" and .confidence != "low"
            )
        )
)