Link: Cryptocurrency fraud with suspicious links

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in ("Financial Communications")
)
and strings.ilike(body.current_thread.text, "*cryptocurrency*", "*bitcoin*")
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in (
              'Advertising and Promotions',
              'Newsletters and Digests',
              'News and Current Events',
              'Legal and Compliance'
            )
)
and not any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "benign" and .confidence == "high"
)
and any(body.links,
        (
          .href_url.domain.tld in $suspicious_tlds
          or .href_url.domain.root_domain in $url_shorteners
          or network.whois(.href_url.domain).days_old < 30
          // 1 distinct link domain that's not the sender domain
          or length(distinct(filter(body.links,
                                    .href_url.domain.root_domain != sender.email.domain.root_domain
                             ),
                             .href_url.domain.root_domain
                    )
          ) == 1
        )
        and (
          any(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
              // known paths
              strings.ilike(.path, "/payouts/img/*", "/img/coins/*")
              // abused service to fetch coin prices
              or .domain.domain == "api.coingecko.com"
              // suspicious TLD that isn't the original link domain
              or (
                .domain.tld in $suspicious_tlds
                and .domain.root_domain != ..href_url.domain.root_domain
              )
          )
          or any(ml.link_analysis(., mode="aggressive").redirect_history,
                 // traversed a domain that is not the body link domain 
OR the effective domain
                 .domain.root_domain != ..href_url.domain.root_domain
                 and .domain.root_domain != ml.link_analysis(.,
                                                             mode="aggressive"
                 ).effective_url.domain.root_domain
          )
          // locate and extract the configuration on the page
          or (
            length(html.xpath(ml.link_analysis(., mode="aggressive").final_dom,
                              '//script/text()'
                   ).nodes
            ) == 1
            and any(html.xpath(ml.link_analysis(., mode="aggressive").final_dom,
                               '//script'
                    ).nodes,
                    any(file.explode(.),
                        length(filter(.scan.javascript.identifiers,
                                      strings.ilike(., "pay*")
                               )
                        ) == 27
                        or any(.scan.javascript.strings,
                               strings.icontains(., "pay.php")
                        )
                    )
            )
          )
        )
)
and not (
  sender.email.domain.root_domain in (
    "gemini.com",
    "ledger.com",
    "binance.com",
    "trezor.io",
    "kraken.com",
    "solana.com",
    "metamask.com",
    "ethereum.org",
    "bloomberg.com"
  )
  and headers.auth_summary.dmarc.pass
)