Service abuse: SurveyMonkey with suspicious outbound links

type.inbound
and sender.email.domain.root_domain == "surveymonkeyuser.com"
and any(html.xpath(body.html, '//table//table//a').nodes,
        .links[0].href_url.domain.root_domain != "surveymonkey.com"
        and not strings.icontains(.inner_text, "survey")
        and not (
          .links[0].href_url.domain.root_domain in (
            "mimecast.com",
            "mimecastprotect.com"
          )
          and any(.links[0].href_url.query_params_decoded['domain'],
                  strings.parse_domain(.).domain in $tenant_domains
                  or strings.parse_domain(.).domain in ("surveymonkey.com", )
          )
        )
)