Attachment with URL shortener (unsolicited)

type.inbound
and any(attachments,
        .file_extension in~ ("pdf")
        and any(file.explode(.), any(.scan.url.urls, .domain.root_domain in $url_shorteners))
)
and (
  (
    sender.email.domain.root_domain in $free_email_providers
    and sender.email.email not in $recipient_emails
  )
  or (
    sender.email.domain.root_domain not in $free_email_providers
    and sender.email.domain.domain not in $recipient_domains
  )
)