Mismatched links: Free file share with urgent language

type.inbound

// Unsolicited + new sender
and (
  profile.by_sender_email().prevalence in ("new", "outlier")
  and not profile.by_sender_email().solicited
)
and not profile.by_sender_email().any_messages_benign

// Free file share
and any(body.links, .href_url.domain.domain in $free_file_hosts)

// urgent language
and 3 of (
  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency"),
  any(ml.nlu_classifier(subject.subject).entities, .name == "urgency"),
  regex.icontains(body.current_thread.text,
                  'immediate
| urgent
| expire
| suspend
| action.{0,20}required
| time.{0,10}sensitive
| verify.{0,20}immediately
| complete.{0,20}requested'
  ),
  regex.icontains(subject.subject,
                  'immediate
| urgent
| expire
| suspend
| action.{0,20}required
| important.{0,20}announcement'
  ),
  regex.icontains(body.current_thread.text,
                  'deadline
| expires?.{0,10}(today
| soon)
| act.{0,10}now
| time.{0,10}running.{0,10}out
| limited.{0,10}time'
  )
)

// Mismatched link
and any(body.links,
        .mismatched == true
        and length(body.links) <= 3
        and not .href_url.domain.root_domain in (
          "mimecast.com",
          "mimecastprotect.com"
        )
)