Brand impersonation: Zoom via lookalike domain

type.inbound
and any(body.current_thread.links,
        not (
          .href_url.domain.root_domain in (
            "zoom.us",
            "zoom.com",
            "zoominternet.net",
            "profitzoom.net",
            "zoomtown.com"
          )
          or (
            .display_url.domain.root_domain is not null
            and .display_url.domain.root_domain in (
              "zoom.us",
              "zoom.com",
              "zoominternet.net",
              "profitzoom.net",
              "zoomtown.com"
            )
          )
        )

        // zoom in the subdomain or sld
        and (
          strings.contains(.href_url.domain.sld, "zoom")
          or strings.contains(.href_url.domain.subdomain, "zoom")
          or strings.contains(.display_url.domain.sld, "zoom")
          or strings.contains(.display_url.domain.subdomain, "zoom")
        )
)
and length(distinct(body.current_thread.links, .href_url.url)) == 1
and sender.email.domain.root_domain in $free_email_providers
and length(recipients.to) == 1
and not subject.is_forward