Link: Job recruitment lure from unsolicited sender with suspicious hosting

type.inbound
// commonly observed abused senders
and sender.email.domain.root_domain in (
  'hireology.com',
  'appsheet.com',
  'welcomekit.co',
  'xero.com',
  'workforce.com',
  'eventbrite.com',
  'tiscali.it',
  'on24event.com',
  'talexio.com',
  'easy.jobs',
  'suitzzedash.com',
  'awsapps.com',
  'beehiiv.com'
)
and regex.icontains(sender.display_name, 'careers
| jobs')
and (
  any(body.links,
      (
        // domain contains brand, but root domain is not legit brand domain
        regex.icontains(.href_url.domain.domain,
                        '(?:ferrari
| tesla
| vuitton
| red[ -]?bull
| nike
| robert[ -]?half
| adidas
| coca[ -]?cola
| instagram
| spotify
| reebok
| marriott
| starbucks
| whatsapp
| ledger
| uber
| ikea
| canva
| bbdo
| mango)'
        )
        and not regex.icontains(.href_url.domain.root_domain,
                                '(?:spotify
| instagram
| ferarri
| tesla
| nike
| adidas
| louisvuitton
| redbull
| roberthalf
| coca-cola
| reebok
| marriott
| starbucks
| whatsapp
| ledger
| uber
| ikea
| canva
| bbdo
| mango)\.com'
        )
      )
      and not regex.icontains(.display_text, 'unsubscribe')
  )
  or (
    regex.icontains(subject.base,
                    '(?:ferrari
| tesla
| vuitton
| red.?bull
| nike
| robert[ _-]?half
| adidas
| coca[ _-]?cola
| instagram
| spotify
| reebok
| marriott
| starbucks
| whatsapp
| ray[ _-]ban
| meta talent
| executive talent
| talent acquisition
| ledger
| \buber\b
| \bikea\b
| canva
| bbdo
| mango)'
    )
    or regex.icontains(sender.display_name,
                       '(?:ferrari
| tesla
| vuitton
| red.?bull
| nike
| robert[ _-]?half
| adidas
| coca[ _-]?cola
| instagram
| spotify
| reebok
| marriott
| starbucks
| whatsapp
| ray[ _-]ban
| meta talent
| executive talent
| talent acquisition
| ledger
| \buber\b
| \bikea\b
| canva
| bbdo
| mango)'
    )
    or regex.icontains(body.current_thread.text,
                       '\b(?:ferrari
| tesla
| vuitton
| red.?bull
| nike
| robert[ _-]?half
| adidas
| coca[ _-]?cola
| spotify
| reebok
| marriott
| starbucks
| whatsapp
| ray[ _-]ban
| meta talent
| executive talent
| talent acquisition
| ledger
| uber
| ikea
| canva
| bbdo
| mango)\b'
    )
    or regex.icontains(sender.display_name,
                       '^[a-z-]+\s*\
| \s*(?:Careers
| Recruitment
| hiring talent
| talent connect
| talents recruitment$)'
    )
    or regex.icontains(sender.display_name, '\bIG\b.*(?:Recruitment
| Strategy)')
  )
)
and not regex.icontains(body.current_thread.text,
                        '\b(?:facebook
| copyright
| llp
| legal
| vip
| representative
| case details
| summit
| training
| conference
| apartments
| live\s*stream
| masterclass
| tickets
| b2b networking
| RSVP
| discover more events
| Marketing e Eventos
| workshop
| register here
| vip
| delivery date)\b'
)