Link: Spam website with evasion indicators

type.inbound
// single meaningful root domain in links
and length(filter(distinct(body.links, .href_url.domain.root_domain),
                  // filter out unrelated domains
                  .href_url.domain.root_domain != sender.email.domain.root_domain
                  and any(recipients.to,
                          .email.domain.root_domain != ..href_url.domain.root_domain
                  )
                  and .href_url.domain.root_domain not in ("aka.ms")
           )
) == 1
// specific spam website pattern
and any(body.links,
        // did not redirect to any other domain
        ml.link_analysis(.).effective_url.domain.domain == .href_url.domain.domain
        and (
          // LinkAnalysis was "evaded"
          any(ml.link_analysis(.).effective_url.query_params_decoded["q"],
              strings.icontains(., "IP provider is blacklisted!")
          )
          // or we encountered the rate limiting
          or ml.link_analysis(.).final_dom.inner_text == "Too Many Requests!"
        )
)