Service abuse: FlipHTML5 with attachment deception and credential theft language

type.inbound
// messages contain wording to "see attached" but contains no attachments
and (
  regex.icontains(body.current_thread.text,
                  "attached
| see.*attached
| find.*attached
| please{0,10}attached"
  )
  and length(attachments) == 0
)
// and the link goes to fliphtml5 and contains suspect "click me" language
and any(body.links, .href_url.domain.root_domain == "fliphtml5.com")
// and we have confidence its cred theft
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)