Sublime MQL rules: predatory

Stage 1: mql_rule

and
  not
    and
      or
        and
          any(headers.hops)
            and
              any(headers.hops.fields)
                and
                  headers.hops.fields[].name eq "X-MS-Exchange-CrossTenant-AuthAs"
                  headers.hops.fields[].value eq "Internal"
              headers.hops.index eq "0"
          not
            and
              headers.auth_summary.dmarc.pass eq "true"
              headers.auth_summary.dmarc.pass is_not_null
        headers.auth_summary.dmarc.pass eq "true"
      sender.email.email eq "quarantine@messaging.microsoft.com"
  not
     macro "any(beta.ml_topic(body.current_thread.text).topics,\n            .name in (\"Health and Wellness\") and .confidence == \"high\"\n)"
  ml.nlu_classifier func_call "ml.nlu_classifier(body.current_thread.text).language == \"english\""
  type.inbound eq "true"
   macro "3 of (\n  regex.count(body.current_thread.text,\n              '[Æ×æı-ijʼnŒœƁƄƇƊƍƓƖƘƠơƤƦƧƬƳƷƼƽǀǁLJ-njDZ-dzȜȢȣɑɡɣɩɪɯʋʏʣʦʪʫ˛ͺͿΑΒΕ-ΗΙΚΜΝΟΡΤΥΧαγινορσυϒϜϨϱ-ϳϹϺЅІЈАВЕЗКМ-ОР-УХЫЬЮабгеорсухѕіјѡѴѵґҮүһҽӀӏӔӕӠԁԌԛ-ԝՍՏՕագզհոռսցքօ׀וטןסװױاه١٥٧ھہە۱۵۷߀ߊ०০৪৭੦੧੪ଠ୦୨ഠ൦๐໐ဝ၀ყჿሀዐᎠ-ᎢᎤᎥᎩ-ᎬᎳᎷᎻᎽᏀᏂᏃᏎᏏᏒᏔᏕᏙᏚᏞᏟᏢᏦᏧᏮᏳᏴᐯᑌᑧᑭᑯᑲᒆ-ᒈᒍᒪᒿᕁᕼᕽᖇᖯᖴᗅᗞᗪᗰᗷ᙭᙮ᚷᛁᛕᛖᴄᴏᴑᴜᴠ-ᴢᴦᵫᶃᶌẝỿι‖₨₶℀-ℂ℅℆ℊ-ℎℐ-ℓℕ№ℙ-ℝ℡ℤℨℬ-ℱℳℴℹ℻ℽⅅ-ⅉⅠ-ⅿ∞∣∥∨∪⊤⋁⋃⋿⍳⍴⍺⏽⑴-⒵╳⟙⤫⤬⨯ⲅⲎⲒⲔⲘⲚⲞⲟⲢ-ⲦⲨⲬⳊⳌⳐⳒⴸⴹⵏⵔⵕⵝ〇ꓐ-ꓔꓖꓗꓙꓚꓜꓝꓟ-ꓣꓦꓧꓪ-ꓬꓮꓰꓲ-ꓴꙄꙇꚘꚙꛟꛯꜨꜱ-ꜽꝎꝏꝚꝪꝮꝷꭵꮁꮃꮓꮩꮪꮯff-fflstﮦ-ﮭﺍﺎﻩ-ﻬＡ-ＣＥＨ-ＫＭ-ＰＳＴＸ-Ｚａｃｅｇ-ｊｌｏｐｓｖｘｙ￨𐊂𐊆𐊇𐊊𐊐𐊒𐊕-𐊗𐊠-𐊢𐊥𐊫𐊰-𐊲𐊴𐋏𐋵𐌁𐌂𐌉𐌑𐌕𐌗𐌚𐌠𐌢𐐄𐐕𐐛𐐠𐐬𐐽𐑈𐒴𐓂𐓎𐓒𐓪𐓶𐔓𐔖𐔘𐔜𐔝𐔥-𐔧𑓐𑜀𑜆𑜊𑜎𑜏𑢠𑢢-𑢤𑢦𑢩𑢬𑢮𑢯𑢲𑢵𑢸𑢻𑢼𑣀-𑣄𑣆𑣈𑣊𑣌𑣕-𑣘𑣜𑣠𑣣𑣥𑣦𑣩𑣬𑣯𑣲𖼈𖼊𖼖𖼨𖼵𖼺𖼻𖽀𖽂𖽃𝐀-𝑔𝑖-𝒜𝒞𝒟𝒢𝒥𝒦𝒩-𝒬𝒮-𝒹𝒻𝒽-𝓃𝓅-𝔅𝔇-𝔊𝔍-𝔔𝔖-𝔜𝔞-𝔹𝔻-𝔾𝕀-𝕄𝕆𝕊-𝕐𝕒-𝚤𝚨𝚩𝚬-𝚮𝚰𝚱𝚳𝚴𝚶𝚸𝚻𝚼𝚾𝛂𝛄𝛊𝛎𝛐𝛒𝛔𝛖𝛠𝛢𝛣𝛦-𝛨𝛪𝛫𝛭𝛮𝛰𝛲𝛵𝛶𝛸𝛼𝛾𝜄𝜈𝜊𝜌𝜎𝜐𝜚𝜜𝜝𝜠-𝜢𝜤𝜥𝜧𝜨𝜪𝜬𝜯𝜰𝜲𝜶𝜸𝜾𝝂𝝄𝝆𝝈𝝊𝝔𝝖𝝗𝝚-𝝜𝝞𝝟𝝡𝝢𝝤𝝦𝝩𝝪𝝬𝝰𝝲𝝸𝝼𝝾𝞀𝞂𝞄𝞎𝞐𝞑𝞔-𝞖𝞘𝞙𝞛𝞜𝞞𝞠𝞣𝞤𝞦𝞪𝞬𝞲𝞶𝞸𝞺𝞼𝞾𝟈𝟊𝟎]'\n  ) > 100,\n  regex.icontains(strings.replace_confusables(body.current_thread.text),\n                  \"Impact Factor\",\n                  \"Special Issue\",\n                  \"Guest Editor\",\n                  \"peer-review\",\n                  \"manuscript\",\n                  \"workshop\",\n                  \"journal (of|editor)\",\n                  \"inclusive research\",\n                  \"abstract\",\n                  \"open-access\",\n                  \"upcoming edition\",\n                  \"title of (your (work|published article)|the study)\",\n                  \"your paper's title\",\n                  \"and the abstract\",\n                  \"abstract of (your work|the study)\",\n                  \"detailed abstract\",\n                  'contribution\\b',\n                  \"accepted paper\",\n                  \"submit.{0,20}.(manuscript|article)\",\n                  \"call for editorial\",\n                  \"reviewer team\",\n                  \"review.{0,15}.(journal|issue)\"\n  ),\n\n  // flattering language, as seen in previous research\n  regex.icontains(strings.replace_confusables(body.current_thread.text),\n                  'your\\s+(article|paper|research|publication|work)\\s+\"?[^\"]+?\"?\\s+(is\\s+very\\s+excellent|strongly\\s+reflects|will\\s+be\\s+a\\s+valuable)',\n                  'we\\s+believe\\s+(that\\s+)?your\\s+(experience|perspective|expertise|comments?)\\s+(will\\s+add|can\\s+play|will\\s+be)\\s+.{0,100}(important|valuable)',\n                  '(you\\s+are\\s+one\\s+of\\s+the\\s+leading\\s+experts?|someone\\s+of\\s+your\\s+caliber)',\n                  '(emerging\\s+voices?\\s+like\\s+yours|shape\\s+the\\s+scholarly\\s+direction)',\n                  '(learning\\s+from\\s+the\\s+internet|know\\s+your\\s+\"[^\"]+\"\\s+is\\s+very\\s+excellent)',\n                  '(world''s|global|international)\\s+(foremost|leading|top|premier)\\s+(authorities|experts|researchers)',\n                  // The \"highly valued\" variants\n                  'your\\s+(participation|contribution|presence|involvement)\\s+(would\\s+be|is)\\s+(highly|greatly|immensely|extremely)\\s+(valued|appreciated|welcomed)',\n\n                  // Time pressure tactics\n                  '(short\\s+notice|busy\\s+schedule|quick\\s+turnaround|urgent\\s+deadline|limited\\s+slots)',\n\n                  // \"No charge\" red flags\n                  '(no\\s+charge|free\\s+of\\s+charge|waived\\s+fee|complimentary|at\\s+no\\s+cost)',\n\n                  // Vague topic promises\n                  '(topic\\s+of\\s+your\\s+choice|any\\s+topic\\s+related|broad\\s+range\\s+of\\s+topics|multidisciplinary\\s+approach)',\n\n                  // Easy publication promises\n                  '(guaranteed\\s+publication|fast\\s+track\\s+review|expedited\\s+process|will\\s+not\\s+be\\s+too\\s+time-consuming)',\n\n                  // Template giveaways\n                  '(do\\s+hope\\s+you\\s+can\\s+make\\s+time|kindly\\s+submit|gentle\\s+reminder|esteemed\\s+researcher)'\n  ),\n\n  // Message contains the users last name, but not their first name\n  // Presumably, this is because names are listed that way on academic papers\n  strings.icontains(body.current_thread.text, mailbox.last_name)\n  and not strings.icontains(body.current_thread.text, mailbox.first_name)\n  and not any(recipients.to,\n              strings.icontains(body.current_thread.text, .email.email)\n  )\n  and length(mailbox.last_name) > 4,\n\n  // Or, message contains the users last, first\n  // Example: Doe, John\n  // Presumably, this is because names are listed that way on academic papers\n  strings.icontains(body.current_thread.text,\n                    strings.concat(mailbox.last_name, \", \", mailbox.first_name)\n  ),\n\n  // new sender or link domain\n  network.whois(sender.email.domain).days_old < 90,\n  any(body.links, network.whois(.href_url.domain).days_old < 90),\n\n  // Crossref DOI registration abuse (https://doi.org/10.29328)\n  any(body.links,\n      .href_url.domain.root_domain == \"doi.org\"\n      and strings.istarts_with(.href_url.path, '/10.29328')\n  ),\n\n  // Sender does not match original thread sender\n  length(body.previous_threads) > 0\n  and any(regex.iextract(body.html.display_text, 'From: (?P<email_address>\\S*)'),\n          strings.parse_email(.named_groups['email_address']).email != sender.email.email\n  ),\n\n  // sent from Windows Server with default name\n  strings.contains(headers.message_id, \"@DESKTOP-\"),\n\n  // requesting a manuscript review\n  strings.ilike(body.current_thread.text, \"*review*\")\n  and strings.ilike(body.current_thread.text, \"*manuscript*\", \"*submission*\"),\n\n  // Chinese registrant country\n  network.whois(sender.email.domain).registrant_country_code == \"CN\",\n  any(body.links,\n      network.whois(.href_url.domain).registrant_country_code == \"CN\"\n  ),\n\n  // Alibaba infrastructure\n  any(headers.domains, .root_domain in (\"aliyun.com\", \"aliyun-inc.com\")),\n\n  // Known predatory journals that we've observed and matched to beallslist.net\n  sender.email.domain.root_domain in (\n    \"iris-research.net\",\n    \"irispublishers.com\",\n    \"lidsen.com\"\n  ),\n\n  // sender domain and body link domains do not match, but have the same registration details\n  (\n    length(body.links) > 0\n    and all(body.links,\n            (\n              network.whois(.href_url.domain).registrant_company == network.whois(sender.email.domain\n              ).registrant_company\n              and network.whois(.href_url.domain).registrar_name == network.whois(sender.email.domain\n              ).registrar_name\n            )\n            and .href_url.domain.root_domain != sender.email.domain.root_domain\n    )\n  ),\n\n  // known patterns\n  any(body.links, regex.imatch(.href_url.path, '^/ey[a-z]/.{2,}$'))\n)"
   macro "any(beta.ml_topic(body.current_thread.text).topics,\n        .name == \"Educational and Research\"\n        and .confidence in (\"medium\", \"high\")\n)"