Sublime MQL rules: scam

type.inbound
// credential theft or scam intent
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft", "job_scam") and .confidence != "low"
)
// employer/workplace review solicitation phrasing
and regex.icontains(body.current_thread.text,
                    '\brate\s+(?:your\s+)?(?:employer|workplace|job)\b',
                    '\breview\s+(?:your\s+)?(?:experience\s+(?:at|with)\s+(?:your|the)\s)',
                    '\b(?:employer|workplace|job)\s+(?:review|rating|feedback)\b',
                    '\bleave\s+(?:a\s+)?(?:review|rating).{0,40}(?:employer|workplace|job)',
                    '(?:glassdoor|comparably|great\s+place\s+to\s+work|kununu|jobcase).{0,40}(?:review|rate|rating|feedback)'
)
and (
  // credential harvesting
  regex.icontains(body.current_thread.text,
                  '(?:enter|provide|confirm|verify).{0,40}(?:password|credentials|login|email\s+and\s+password)',
                  'verify\s+your\s+(?:identity|eligibility|account|profile)',
                  '(?:password|credential|login).{0,30}(?:enter|provide|confirm|verify|required)'
  )
  // or monetary incentive
  or regex.icontains(body.current_thread.text,
                     'gift.?card',
                     '(?:receive|earn|get|claim).{0,30}[\$€£]\d+',
                     '[\$€£]\d+.{0,30}(?:gift|reward|credit|incentive|voucher|bonus|prize)',
                     'token\s+of\s+(?:our\s+)?(?:appreciation|thanks|gratitude)'
  )
)
// negating legitimate/trusted employer review/rating senders
and not (
  (
    sender.email.domain.root_domain in (
      'comparably.com',
      'greatplacetowork.com',
      'builtin.com',
      'lensa.com',
      'ziprecruiter.com',
      'kununu.com',
      'jobcase.com',
      'trustpilot.com'
    )
    or sender.email.domain.root_domain in $high_trust_sender_root_domains
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// subject cites employer review / rating / feedback context
and regex.icontains(subject.subject,
                    '\breview\b',
                    '\brating\b',
                    '\brate\b',
                    '\bfeedback\b',
                    '\btestimonial\b',
                    '\b(?:employer|workplace|company|employee|job)\b',
                    '\b(?:glassdoor|indeed|linkedin|comparably|great\s+place\s+to\s+work|built\s?in|lensa|ziprecruiter|kununu|jobcase|trustpilot)\b',
                    '\bexperience\b',
                    '\bsurvey\b',
                    '\bopinion\b'
)

length(body.current_thread.links) < 10
and length(body.current_thread.text) < 3000
and (
  regex.icontains(body.current_thread.text,
                  '(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)\s*[^\r\n]{0,50}(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)',
                  '(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)\s*[^\r\n]{0,50}(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)'
  )
  or regex.icontains(body.current_thread.text,
                     '(?:Caterpillar|\bCAT\b|John\s*Deere|Kubota|Bobcat|Honda|Generac|Stihl|Husqvarna|\bToro\b)\s*[^\r\n]{0,50}(?:\bgenerator\b|\bchainsaw\b|\bexcavator\b|\bskid\s*steer\b|\btractor\b|\bmower\b|\bloader\b|\bbackhoe\b)'
  )
  or regex.icontains(body.current_thread.text,
                     '(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)\s*[^\r\n]{0,50}(?:available|sale|rehome|gift|giving\s*away|free)',
                     '(?:available|sale|rehome|gift|giving\s*away|free)\s*[^\r\n]{0,50}(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)'
  )
  or strings.ilike(body.current_thread.text,
                   '*welding tools*',
                   '*tools and accessories*'
  )
  or (
    length(regex.extract(body.current_thread.text,
                         '(?i)(?:generator|refrigerator|trailer|tractor|lawnmower|mower|washer|dryer|freezer|treadmill|peloton|vanity|dresser|couch|sectional|kennel|mattress|bed\s*frame|hot\s*tub|golf\s*cart|tv|gazebo|loveseat|dishwasher|microwave|kitchenaid|rolex|watch|honda|toyota|ford|chevy|jeep|kubota|bobcat|polaris|kawasaki|macbook|iphone|playstation|ps5|xbox|canon|sony|dji|piano|keyboard|guitar|violin)\b[^\r\n]{0,30}(?:\(\s*\d{2,5}\s*\)|\$\s*\d{2,5}|\bfor\s+\$?\d{2,5})'
           )
    ) >= 5
    and regex.icontains(body.current_thread.text,
                        'late (?:husband|father|dad|wife|mother|mom)',
                        '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate'
    )
  )
)
and (
  regex.icontains(body.current_thread.text,
                  'late (?:husband|father|dad|wife|mother|mom)',
                  '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate',
                  'inherited instruments',
                  'just lost (?:her|his|their) (?:husband|father|dad|wife|mother|mom)'
  )
  or strings.ilike(body.current_thread.text,
                   '* downsizing *',
                   '* relocating soon *',
                   '* to relocate *',
                   '*prepares to relocate*',
                   '*relocate with*family*'
  )
  or strings.ilike(body.current_thread.text,
                   '*sponsored*giveaway*',
                   '*giveaway*sponsored*',
                   '* generously offering *',
                   '* generous offer *',
                   '*a loving home*',
                   '*a good home*',
                   '*find a new home *',
                   '*rehome these instruments *',
                   '* free donation*'
  )
  or regex.icontains(body.current_thread.text,
                     'giv\w+\s+away\s+(?:her|his|their|my|our)\s+(?:late|deceased|dad|father|mother|husband|wife)',
                     'giv\w+\s+away\s+(?:her|his|their|my|our)[^\r\n]{0,40}(?:tool|welder|welding|equipment|instrument|machine)'
  )
  or strings.ilike(body.current_thread.text,
                   '*generous opportunity*',
                   '*who needs a reliable*',
                   '*comprehensive set of tools*',
                   '*top-of-the-line machine*'
  )
)
and (
  regex.icontains(body.current_thread.text,
                  'shipping (?:fee|cost|arrangement)',
                  '(?:responsible|pay) for shipping',
                  'no (?:local\s)?pick.?up',
                  '(?:local\s)?pick.?up.{0,50}not available',
                  'delivery only',
                  'moving company'
  )
  or strings.ilike(body.current_thread.text,
                   '* if you will take it *',
                   '* or have someone *',
                   '* indicate your interest *',
                   '* to someone you know *',
                   '* know someone who *',
                   '* someone you know would *',
                   '* someone who will *',
                   '* someone who truly *',
                   '* anyone you know *'
  )
  or regex.icontains(body.current_thread.text,
                     'if you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested',
                     '(?:any|some)one[^\r\n]{0,20}(is|will|would|might be)[^\r\n]{0,20}interested',
                     'who (?:will|would|might) appreciate'
  )
  or (
    any(regex.extract(body.current_thread.text,
                      "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
        ),
        strings.parse_email(.full_match).domain.domain in $free_email_providers
        or strings.parse_email(.full_match).domain.root_domain in $free_email_providers
    )
    or (
      length(headers.reply_to) > 0
      and sender.email.email not in map(headers.reply_to, .email.email)
    )
    or length(recipients.to) == 0
    or regex.icontains(body.current_thread.text,
                       '(?:call|contact|text)[^\r\n]{0,50} at'
    )
    or regex.icontains(body.current_thread.text,
                       '(?:private|personal|primary) (?:e-?)?mail'
    )
    or strings.icontains(body.current_thread.text,
                         'happy to answer any questions you may have'
    )
    or strings.icontains(body.current_thread.text, ' kindly ')
    or strings.icontains(body.current_thread.text, ' (kindly ')
  )
)

length(body.links) < 10
and length(body.current_thread.text) < 2000
and (
  // body detection
  // be sure to update the attachment detection regexes too!
  (
    (
      // items and brands
      // Guitars
      regex.icontains(body.current_thread.text,
                      '(?:Gibson|Fender|Lowden|Martin|Taylor|Ibanez|Knaggs)\s*[^\r\n]{0,50}\s*guitar',
                      'guitar\s*[^\r\n]{0,50}\s*(?:Gibson|Fender|Lowden|Martin|Taylor|Ibanez|Knaggs)',
      )
      // Piano/Keyboards
      or regex.icontains(body.current_thread.text,
                         '(?:Yamaha|Kawai|Baldwin|Roland|Stei?nway(?: (?:&|and) Sons?)?|\d{4})\s*[^\r\n]{0,50}(?:baby.grand|piano|baby.grand.piano|keyboard)',
                         '(?:baby.grand|piano|baby.grand.piano|keyboard)\s*[^\r\n]{0,50}(?:Yamaha|Kawai|Baldwin|Roland|Stei?nway(?: (?:&|and) Sons?)?|\d{4})',
                         // strong indicators for generalized instrument
                         '(?:piano|keyboard)\s*[^\r\n]{0,50}(?:available|sale|rehome|gift)'
      )
      // Violins & Orchestral 
      or regex.icontains(body.current_thread.text,
                         '(?:Stradivarius|Guarneri|Yamaha|Stentor|Eastman|Cremona|Cecilio|Mendini)\s*[^\r\n]{0,50}(violin|viola|cello|celli)',
      )
      // brass/wind/woodwinds
      or regex.icontains(body.current_thread.text,
                         '(?:Bach|Yamaha|Selmer|Conn|King|Jupiter|Buffet Crampon |Pearl)\s*[^\r\n]{0,50}(trombone|trumpet|saxophone|clarinet|flute)'
      )

      // generic
      or strings.ilike(body.current_thread.text,
                       '* musical instruments *',
                       '* instrument as a gift*'
      )
    )
    and (
      // often a person is moving
      strings.ilike(body.current_thread.text,
                    '* downsizing *',
                    '* relocating *',
                    '* to relocate *',
                    '* relocation *',
                    '* moving *'
      )
      or strings.ilike(body.current_thread.text,
                       '* give away*',
                       '* generously offering *',
                       '*a loving home*',
                       '*a good home*',
                       '*find a new home *',
                       '*rehome these instruments *',
                       '* free donation*',
                       '*free*member of the music community*'
      )
      // generally someone died
      or regex.icontains(body.current_thread.text,
                         'inherited instruments',
                         'late (?:husband|father|dad|wife|mother|mom)',
                         '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate'
      )
      // passion/love for the item
      or strings.ilike(body.current_thread.text,
                       '* genuinely cherish*',
                       '* cherished possessions*',
                       '* passionate instrument*',
                       '* music lover*',
                       '* had a passion for music*',
                       '* appreciates music*',
                       "* special piece*",
                       "* a lot of meaning*",
                       "* profound sentimental*",
                       '* will cherish*',
                       '* passion for music*',
                       '* treasured items *'
      )
    )
    and (
      // it talks about a shipping fee upfront
      regex.icontains(body.current_thread.text,
                      'shipping (?:fee|cost|arrangement)',
                      '(?:responsible|pay) for shipping',
                      'no (?:local\s)?pick.?up',
                      '(?:local\s)?pick.?up.{0,50}not available',
                      'delivery only',
                      'moving company'
      )
      // recipient or someone they know might have an interest
      or strings.ilike(body.current_thread.text,
                       '* if you will take it *',
                       '* or have someone *',
                       '* indicate your interest *',
                       '* to someone you know *',
                       '* know someone who *',
                       '* someone you know would *',
                       '* someone who will *',
                       '* someone who truly *',
                       '* anyone you know *',
      )
      or regex.icontains(body.current_thread.text,
                         'if you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested',
                         '(?:any|some)one[^\r\n]{0,20}(is|will|would|might be)[^\r\n]{0,20}interested',
                         'who (?:will|would|might) appreciate',
      )
      or (
        // there's an email in the body 
        any(regex.extract(body.current_thread.text,
                          "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
            ),
            strings.parse_email(.full_match).domain.domain in $free_email_providers
            or strings.parse_email(.full_match).domain.root_domain in $free_email_providers
        )
        // reply-to doesn't match sender
        or (
          length(headers.reply_to) > 0
          and sender.email.email not in map(headers.reply_to, .email.email)
        )
        // there are no recipients
        or length(recipients.to) == 0
        // redirects to a phone number
        or regex.icontains(body.current_thread.text,
                           '(?:call|contact|text)[^\r\n]{0,50} at'
        )
        or regex.icontains(body.current_thread.text,
                           '(?:private|personal) (?:e-?)?mail'
        )
        or strings.icontains(body.current_thread.text, ' kindly ')
        or strings.icontains(body.current_thread.text, ' (kindly ')
      )
    )
  )
  or (
    any(filter(attachments, .size < 10000),
        (
          // items and brands
          // Guitars
          regex.icontains(file.parse_text(.).text,
                          '(?:Gibson|Fender|Lowden|Martin|Taylor|Ibanez|Knaggs)\s*[^\r\n]{0,50}\s*guitar',
                          'guitar\s*[^\r\n]{0,50}\s*(?:Gibson|Fender|Lowden|Martin|Taylor|Ibanez|Knaggs)',
          )
          // Piano/Keyboards
          or regex.icontains(file.parse_text(.).text,
                             '(?:Yamaha|Kawai|Baldwin|Roland|Stei?nway(?: (?:&|and) Sons?)?)\s*[^\r\n]{0,50}(?:baby.grand|piano|baby.grand.piano|keyboard)',
                             '(?:baby.grand|piano|baby.grand.piano|keyboard)\s*[^\r\n]{0,50}(?:Yamaha|Kawai|Baldwin|Roland|Stei?nway(?: (?:&|and) Sons?)?|\d{4})',
                             // strong indicators for generalized instrument
                             '(?:piano|keyboard)\s*[^\r\n]{0,50}(?:available|sale|rehome|gift)'
          )
          // Violins & Orchestral 
          or regex.icontains(file.parse_text(.).text,
                             '(?:Stradivarius|Guarneri|Yamaha|Stentor|Eastman|Cremona|Cecilio|Mendini)\s*[^\r\n]{0,50}(violin|viola|cello|celli)',
          )
          // brass/wind/woodwinds
          or regex.icontains(file.parse_text(.).text,
                             '(?:Bach|Yamaha|Selmer|Conn|King|Jupiter|Buffet Crampon |Pearl)\s*[^\r\n]{0,50}(trombone|trumpet|saxophone|clarinet|flute)'
          )

          // generic
          or strings.ilike(file.parse_text(.).text,
                           '* musical instruments *',
                           '* instrument as a gift*'
          )
        )
        and (
          // often a person is moving
          strings.ilike(file.parse_text(.).text,
                        '* downsizing *',
                        '* relocating *',
                        '* to relocate *',
                        '* relocation *',
          )
          or strings.ilike(file.parse_text(.).text,
                           '* give away*',
                           '* generously offering *',
                           '*a loving home*',
                           '*a good home*',
                           '*find a new home *',
                           '*rehome these instruments *',
                           '* free donation*',
                           '*free*member of the music community*'
          )
          // generally someone died
          or regex.icontains(file.parse_text(.).text,
                             'inherited instruments',
                             'late (?:husband|father|dad|wife|mother|mom)',
                             '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate'
          )
          // passion/love for the item/music
          or strings.ilike(file.parse_text(.).text,
                           '* genuinely cherish*',
                           '* cherished possessions*',
                           '* passionate instrument*',
                           '* music lover*',
                           '* had a passion for music*',
                           '* appreciates music*',
                           "* special piece*",
                           "* a lot of meaning*",
                           "* profound sentimental*",
                           '* will cherish*',
                           '* passion for music*',
                           '* treasured items *'
          )
        )
        and (
          // it talks about a shipping fee upfront
          regex.icontains(file.parse_text(.).text,
                          'shipping (?:fee|cost|arrangement)',
                          '(?:responsible|pay) for shipping',
                          'no (?:local\s)?pick.?up',
                          '(?:local\s)?pick.?up.{0,50}not available',
                          'delivery only',
                          'moving company'
          )
          or strings.ilike(file.parse_text(.).text,
                           '* if you will take it *',
                           '* or have someone *',
                           '* indicate your interest *',
                           '* to someone you know *',
                           '* know someone who *',
                           '* someone you know would *',
                           '* someone who will *',
                           '* anyone you know *',
          )
          or regex.icontains(file.parse_text(.).text,
                             'if you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested',
                             '(?:any|some)one[^\r\n]{0,20}(is|will|would|might be)[^\r\n]{0,20}interested',
                             'who (?:will|would|might) appreciate',
          )
          // there's an email in the body 
          or any(regex.extract(file.parse_text(.).text,
                               "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
                 ),
                 strings.parse_email(.full_match).domain.domain in $free_email_providers
                 or strings.parse_email(.full_match).domain.root_domain in $free_email_providers
          )

          // reply-to doesn't match sender
          or (
            length(headers.reply_to) > 0
            and sender.email.email not in map(headers.reply_to, .email.email)
          )
          // there are no recipients
          or length(recipients.to) == 0
          // redirects to a phone number
          or regex.icontains(file.parse_text(.).text,
                             '(?:call|contact|text)[^\r\n]{0,50} at'
          )
          or regex.icontains(file.parse_text(.).text,
                             '(?:private|personal) (?:e-?)?mail'
          )
          or strings.icontains(file.parse_text(.).text, ' kindly ')
          or strings.icontains(file.parse_text(.).text, ' (kindly ')
        )
    )
  )
)

// not high trust sender domains
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and headers.auth_summary.dmarc.pass
)
and not sender.email.domain.root_domain in (
  'ridleyacademy.com', // person provides piano lessons and offers to give a Roland baby-grand away
  'mountainpiano.com' // legitimate piano moving company in Denver 
)