Link: Romance/Sexual Language With Suspicious Link

type.inbound
and length(body.previous_threads) == 0
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in ("Romance", "Sexually Explicit Messages")
        and .confidence == "high"
)
and 1 of (
  any(body.links, network.whois(.href_url.domain).days_old < 30),
  any(body.links, .href_url.domain.root_domain in $url_shorteners),
  any(body.links, .href_url.domain.domain in $free_subdomain_hosts),
  any(body.links, .href_url.domain.tld in ('ru', 'app', 'digital', 'click')),
  any(headers.reply_to, network.whois(.email.domain).days_old < 30)
)
and 0 < length(distinct(body.links,
                        .href_url.domain.root_domain not in ("aka.ms")
               )
) < 3
and all(body.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
)