Sublime MQL rules: spam

type.inbound
// Check for emoji in sender display name using Unicode ranges
and regex.contains(sender.display_name,
                   '[\x{1F600}-\x{1F64F}]|[\x{1F300}-\x{1F5FF}]|[\x{1F680}-\x{1F6FF}]|[\x{1F1E0}-\x{1F1FF}]|[\x{2600}-\x{26FF}]|[\x{2700}-\x{27BF}]'
)
// Check for financial symbols in subject
and regex.contains(subject.subject, '[\$£€¥₿]')
and (
  headers.auth_summary.dmarc.pass is null
  or headers.auth_summary.dmarc.pass == false
)
and sender.email.domain.root_domain not in $alexa_1m

type.inbound
// single meaningful root domain in links
and length(filter(distinct(body.links, .href_url.domain.root_domain),
                  // filter out unrelated domains
                  .href_url.domain.root_domain != sender.email.domain.root_domain
                  and any(recipients.to,
                          .email.domain.root_domain != ..href_url.domain.root_domain
                  )
                  and .href_url.domain.root_domain not in ("aka.ms")
           )
) == 1
// specific spam website pattern
and any(body.links,
        // did not redirect to any other domain
        ml.link_analysis(.).effective_url.domain.domain == .href_url.domain.domain
        and (
          // LinkAnalysis was "evaded"
          any(ml.link_analysis(.).effective_url.query_params_decoded["q"],
              strings.icontains(., "IP provider is blacklisted!")
          )
          // or we encountered the rate limiting
          or ml.link_analysis(.).final_dom.inner_text == "Too Many Requests!"
        )
)

type.inbound
and length(body.current_thread.text) < 2000
and length(body.links) < 5
and any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).topics,
        .name in ("Contact List Solicitation", "B2B Cold Outreach")
        and .confidence in ("medium", "high")
)
and (
  (
    (
      any([subject.subject, body.current_thread.text],
          (
            regex.icontains(.,
                            '(?:Attendee|Buyer|Contact|Decision Maker|Email|Member|Participant|Professional|Registrant|User|Visitor|Store|Grocer|Lead)(?:[[:punct:]]*s)?(?:\s\w*){0,9}(?:\blist(?:\b|[^ei])|database)'
            )
            and not (
              regex.icount(.,
                           '(email|contact)(?:[[:punct:]]*s)?(?:\s\w*){0,9}list'
              ) == 1
              and regex.icontains(.,
                                  '(?:unsub|remove|safe|delete|leave|update|part of|be added|safe)[[:punct:]]*s?(?:\s\w*){0,9}(mailing|email|my|sender)(?:\s\w*){0,9}list(?:\b|[^ei])',
                                  'email list(?:\b|[^ei])[[:punct:]]*s?(\s\w*){0,5}(?:unsub|remove|safe|delete|leave|up to date|part of|be added)'
              )
            )
          )
          or regex.icontains(.,
                             '\b(?:list|database)(?:[[:punct:]]*s)?\b(\s\w*){0,9}(?:Attendee|Buyer|Contact|Decision Maker|Email|Member|Participant|Professional|Registrant|User|Visitor|Store|Grocer)s?'
          )
      )
    )
    and (
      regex.icontains(body.current_thread.text,
                      "(?:interest(s|ed)|accessing|purchas|obtain|acuir|sample|provide.{0,10}samples|counts|pricing)"
      )
      or any(body.previous_threads,
             regex.icontains(.text,
                             "(?:interest(s|ed)|accessing|purchas|obtain|acuir|sample|provide.{0,10}samples|counts|pricing)"
             )
      )
    )
    and not regex.icontains(body.current_thread.text,
                            "(?:debit card|transaction.{0,20}processed)"
    )
  )
  // if there are indicators of a previous thread, also inspect the previous thread
  or (
    // contains references to the previous thread
    2 of (
      regex.icontains(body.current_thread.text, '(?:get|got|had) a chance'),
      regex.icontains(body.current_thread.text, '(take|move)(\Wthis)?\Wforward'),
      regex.icontains(body.current_thread.text,
                      '(review|drop me a line about) (my|this|it)'
      ),
      regex.icontains(body.current_thread.text, 'missed it( the)? first time'),
      regex.icontains(body.current_thread.text,
                      '(?:below|previous(ly)?|last|prior|earlier) (message|email|sent)'
      ),
      regex.icontains(body.current_thread.text,
                      // "the email I sent you earlier"
                      '(e?mail|message).{0,20}(sent).{0,20}(?:below|previous(ly)?|last|prior|earlier)'
      ),
      regex.icontains(body.current_thread.text,
                      '(sent).{0,50}(e?mail|message) (?:below|previous(ly)?|last|prior|earlier)'
      ),
      regex.icontains(body.current_thread.text, 'follow(?:ing)?(-| )up'),
      regex.icontains(body.current_thread.text, '(?:contact|attendee)s? list'),
      regex.icontains(body.current_thread.text, '(any|get an) update.{0,50}\?'),
      regex.icontains(body.current_thread.text, '(heard?|circling) back'),
      strings.icontains(body.current_thread.text, 'recently sent'),
      strings.icontains(body.current_thread.text, 'still interested'),
      regex.icontains(body.current_thread.text,
                      'did you (get|receive) (it|my (message|e?mail))'
      ),
      regex.icontains(body.current_thread.text, '(swift|quick|short) response'),
      regex.icontains(body.current_thread.text, 'kindly.{0,30}.interested'),
    )
    and any([body.html.display_text, body.plain.raw],
            (
              3 of (
                strings.icontains(., "from:"),
                strings.icontains(., "to:"),
                strings.icontains(., "sent:"),
                strings.icontains(., "date:"),
                strings.icontains(., "cc:"),
                strings.icontains(., "subject:"),
                strings.icontains(., "--Original Message--")
              )
              or strings.icontains(.,
                                   strings.concat(sender.display_name,
                                                  " <",
                                                  sender.email.email,
                                                  "> wrote:"
                                   )
              )
            )
            // match _after_ the previous thread indciators
            and (
              regex.icontains(.,
                              '(?:from|to|sent|date|cc|subject|wrote):(.|\W)*(?:Attendee|Buyer|Contact|Decision Maker|Email|Member|Participant|Professional|Registrant|User|Visitor|Mailing)(?:[[:punct:]]*s)?(?:\s\w*){0,9}(?:list(?:\b|[^ei])|database)'
              )
              or regex.icontains(.,
                                 '(?:from|to|sent|date|cc|subject|wrote):(.|\W)*(?:list(?:\b|[^ei])|database)(?:[[:punct:]]*s)?(\s\w*){0,9}(?:Attendee|Buyer|Contact|Decision Maker|Email|Member|Participant|Professional|Registrant|User|Visitor|Mailing)s?'
              )
              or (
                2 of (
                  strings.icontains(., "provide counts"),
                  regex.icontains(., "(?:verified|fresh) data"),
                  strings.icontains(., "precise targeting"),
                  strings.icontains(., "deliverability"),
                  regex.icontains(., "target (verticals|regions|criteria)")
                )
                and regex.icontains(., '(?:list(?:\b|[^ei])|database)')
              )
            )
    )
  )
)
// negate Zendesk support tickets
and not any(body.links,
            .href_url.domain.root_domain in ('zendesk.com')
            and .display_text == 'Zendesk'
)
and not profile.by_sender().solicited
and not profile.by_sender().any_messages_benign

type.inbound
and regex.imatch(sender.email.email, 'communications[a-z]{4,}@.+')
and any(headers.hops, any(.fields, strings.ilike(.name, "x-campaignid")))
and any(headers.domains, strings.contains(.domain, "blackbaud.com"))
and regex.imatch(subject.subject, 'RE\s?:.*')
and (length(headers.references) == 0 or headers.in_reply_to is null)
and any(body.links, .display_text is null)

type.inbound
and length(body.links) > 0
and any(body.links, length(.display_text) > 3000)
and any(body.links,
        regex.icontains(.display_text, '(\bPassword:)', 'Hi.{0,5}Welcome\b')
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

type.inbound
and length(attachments) == 0
and regex.icontains(coalesce(body.html.inner_text, body.html.display_text),
                    '([a-zA-Z\d\.]\s){30,}'
)
and any(body.links,
        .href_url.domain.domain in $free_file_hosts
        or .href_url.domain.root_domain in $free_file_hosts
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or profile.by_sender().any_messages_malicious_or_spam
  or sender.email.domain.valid == false
)
and not profile.by_sender().any_messages_benign

type.inbound
// newly registered sender domain
and network.whois(sender.email.domain).days_old < 365
// there are 2 name servers which have subdomains ending with .ns
and length(network.whois(sender.email.domain).name_servers) == 2
and all(network.whois(sender.email.domain).name_servers,
        strings.iends_with(.subdomain, '.ns')
        and .root_domain == 'cloudflare.com'
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == 'B2B Cold Outreach'
)

type.inbound
and (
  (
    any(html.xpath(body.html, "//div[contains(@style, 'BACKGROUND: URL')]").nodes,
        .raw is not null
    )
  )
  or (
    any(body.links,
        any([
              "blob.core.windows.net",
              "click.email.formula1.com",
              "firmy-praha.eu"
            ],
            ..href_url.domain.domain == .
            or strings.ends_with(..href_url.domain.domain, .)
        )
    )
  )
)
and (
  (
    // subject has # plus random characters only
    regex.icontains(subject.base, "#[a-z0-9]{5,}?")
    // plus one of these
    and (
      // display name has a # + random characters only
      regex.icontains(sender.display_name, "#[a-z0-9]{5,}?")
      // subject starts with a period (yes, both subject cases should be true)
      or strings.starts_with(subject.base, ".")
      // Display name contains at least 2 emojis
      or length(distinct(map(regex.extract(sender.display_name,
                                           '(?P<emoji>[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}])'
                             ),
                             .full_match
                         )
                )
      ) >= 2
    )
  )
  or (
    // Subject contains at least 2 emojias
    length(distinct(map(regex.extract(subject.base,
                                      '(?P<emoji>[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}])'
                        ),
                        .full_match
                    )
           )
    ) >= 2
  )
  or 
  // another variant with different strings that have numbers but the same pattern is in both subject and displayname
  (
    // subject has # plus random characters & numbers
    regex.icontains(subject.base, "#[1-9a-z]+")
    // plus one of these
    and (
      regex.icontains(sender.display_name, "#[1-9a-z]+")
      or strings.icontains(sender.display_name, "rewards")
    )
  )
  or (
    // or prornotions (promotions) once confusables are stripped in subject
    strings.icontains(strings.replace_confusables(subject.base), "prornotions")
    // and rewards in display name
    and strings.icontains(sender.display_name, "rewards")
  )
  or (
    // subject has * plus 4 random characters and numbers *
    regex.icontains(subject.base, '\*[1-9a-z]{4,}\*')
    // same with the display name
    and regex.icontains(sender.display_name, '\*[1-9a-z]{4,}\*')
  )
  or (
    // subject and display name has two *
    strings.count(subject.base, "*") == 2
    and strings.count(sender.display_name, "*") == 2
  )
  or (
    // subject has string of random characters and numbers
    // checking if string has 1 uppercase, 1 lowercase and 1 number
    any(regex.extract(subject.base, '(?:-{1,2}|\s)([a-zA-Z0-9]{11,})'),
        regex.contains(.full_match, '[A-Z]')
        and regex.contains(.full_match, '[a-z]')
        and regex.contains(.full_match, '[0-9]')
        // some matches are legit but they are 35+ characters
        and length(.full_match) <= 30
    )
    // negating support thread email subjects containg multiple : in their IDs
    and not regex.count(subject.base, ':') > 5
  )
)

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in ("Financial Communications")
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in (
              'Newsletters and Digests',
              'News and Current Events',
              'Legal and Compliance'
            )
)
and not any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "benign" and .confidence == "high"
)
// action word
and (
  strings.ilike(subject.base, '*airdrop*')
  or strings.like(body.current_thread.text, '*airdrop*')
  or strings.ilike(subject.base, '*giveaway*')
  or strings.like(body.current_thread.text, '*giveaway*')
  or regex.icontains(body.current_thread.text, 'receive \$\d{2,5} worth')
  or regex.icontains(body.current_thread.text,
                     'claim your (allocation|airdrop|bonus|share|\$\d{2,5})'
  )
  or regex.icontains(body.current_thread.text, 'connect .{0,20} wallet')
)
and not regex.icontains(body.current_thread.text, '\$\d{2,4} (off|cash)')
and (
  // crypto keyword
  regex.icontains(body.current_thread.text,
                  '\bmetamask\b',
                  '\bethereum\b',
                  '\bbinance\b',
                  '\bgemini\b',
                  '\bwallet\b',
                  '\bkraken\b',
                  '\bsolana\b',
                  '\btrezor\b',
                  '\bledger\b'
  )
  // token name, e.g. $USDT
  or regex.contains(body.current_thread.text, '\s\$[A-Z]{3,4}\s')
)
and not (
  sender.email.domain.root_domain in (
    "gemini.com",
    "ledger.com",
    "binance.com",
    "trezor.io",
    "kraken.com",
    "solana.com",
    "metamask.com",
    "ethereum.org",
    "bloomberg.com"
  )
  and headers.auth_summary.dmarc.pass
)

type.inbound
and (
  sender.email.domain.root_domain == "onmicrosoft.com"
  or (
    strings.icontains(sender.display_name, "onmicrosoft.com")
    and sender.email.domain.valid == false
  )
)
and length(recipients.to) < 2
and length(body.links) > 0

// bounce-back negations
and not strings.like(sender.email.local_part,
                     "*postmaster*",
                     "*mailer-daemon*",
                     "*administrator*"
)
and not any(attachments,
            .content_type in (
              "message/rfc822",
              "message/delivery-status",
              "text/calendar"
            )
            or (.content_type == "text/plain" and .file_extension == "ics")
)

// negating legit replies
and not (
  (
    strings.istarts_with(subject.subject, "RE:")
    or strings.istarts_with(subject.subject, "FW:")
    or strings.istarts_with(subject.subject, "FWD:")
    or regex.imatch(subject.subject,
                    '(\[[^\]]+\]\s?){0,3}(re|fwd?|automat.*)\s?:.*'
    )
    or strings.istarts_with(subject.subject, "Réponse automatique")
  )
  and (length(headers.references) > 0 and headers.in_reply_to is not null)
)

// negate auto-replies
and not (
  any(headers.hops,
      any(.fields, .name =~ "auto-submitted" and .value =~ "auto-generated")
      and any(.fields,
              .name =~ "X-MS-Exchange-Generated-Message-Source"
              and .value not in ("Antispam Quarantine Agent")
      )
  )
)

// Microsoft has some legit onmicrosoft domains...
and not (
  sender.email.domain.domain == "microsoft.onmicrosoft.com"
  and headers.auth_summary.spf.pass
  and all(body.links, .href_url.domain.root_domain == "microsoft.com")
)

// negate legitimate microsoft b2b applications invitations
and not (
  length(body.links) > 0
  and (
    sender.email.local_part == "invites"
    and sender.email.domain.root_domain == "onmicrosoft.com"
    // infra validated message id
    and strings.icontains(headers.message_id, "pepf")
  )
)

// construct the proper sender domain and check against known recipients
and not strings.concat(sender.email.domain.subdomain,
                       ".",
                       sender.email.domain.tld
) in $recipient_domains

// sender profiles
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

// negate org domains
and not (
  sender.email.domain.domain in $org_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
and sender.email.domain.root_domain in $free_email_providers
// not a reply
and length(headers.references) == 0
and 0 < length(distinct(body.current_thread.links, .href_url.domain.root_domain)
) <= 3
and any(body.links,
        (
          any(values(.href_url.query_params_decoded),
              any(.,
                  strings.parse_email(.).email in map(recipients.to,
                                                      .email.email
                  )
              )
          )
        )
        or regex.icontains(.display_text,
                           '(?:(open|view|read|private).{0,15}message)'
        )
        or any([.href_url.path, .display_text],
               any((ml.nlu_classifier(.).topics),
                   .name in ("Romance", "Sexually Explicit Messages")
               )
        )
        // visit the URL and check the effecitve url
        or any(values(ml.link_analysis(.).effective_url.query_params_decoded),
               any(.,
                   strings.parse_email(.).email in map(recipients.to,
                                                       .email.email
                   )
               )
        )
)
and (
  any(ml.nlu_classifier(body.current_thread.text).entities,
      .name == "org"
      and strings.ilike(.text,
                        "*Flirt*",
                        "*Singles*",
                        "*Date*",
                        "*Dating*",
                        "*Girls*",
                        "*Love*",
                        "*Hook*up*"
      )
  )
  or any(ml.nlu_classifier(body.current_thread.text).topics, .name == "Romance")
)

type.inbound
and length(attachments) == 0
and (
  (
    (
      (
        (length(body.plain.raw) < 500 and length(body.current_thread.text) == 0)
        or (
          length(body.html.display_text) < 500
          and length(body.current_thread.text) == 0
        )
        or length(body.current_thread.text) < 500
        or any(map(filter(ml.nlu_classifier(body.current_thread.text).entities,
                          .name == "disclaimer"
                   ),
                   .text
               ),
               (length(body.current_thread.text) - length(.)) < 500
        )
      )
      and (
        strings.ilike(subject.subject,
                      "*picture*",
                      "*photo*",
                      "*image*",
                      "*sad news*",
                      "*sad announcement*",
                      "*sad update*",
                      "*new pics*",
                      "*Reunion*",
                      "*planing*",
                      "*back memories*",
                      "*any memories*",
                      "*old memories*",
                      "*evoke memories*",
                      "*bittersweet memories*"
        )
        or regex.icontains(subject.base, 'pics?\s*\(\d{1,2}\)')
      )
    )
    or (
      (
        (
          length(body.html.display_text) < 500
          and length(body.current_thread.text) == 0
        )
        and strings.ilike(body.html.display_text,
                          "*picture*",
                          "*photo*",
                          "*image*",
                          "*sad news*",
                          "*sad announcement*",
                          "*sad update*",
                          "*new pics*",
                          "*back memories*",
                          "*any memories*",
                          "*old memories*",
                          "*evoke memories*",
                          "*bittersweet memories*"
        )
      )
      or (
        (length(body.plain.raw) < 500 and length(body.current_thread.text) == 0)
        and strings.ilike(body.plain.raw,
                          "*picture*",
                          "*photo*",
                          "*image*",
                          "*sad news*",
                          "*sad announcement*",
                          "*sad update*",
                          "*new pics*",
                          "*back memories*",
                          "*any memories*",
                          "*old memories*",
                          "*evoke memories*",
                          "*bittersweet memories*"
        )
        and not strings.icontains(body.plain.raw, "[cid:image")
      )
      or (
        length(body.current_thread.text) < 500
        and strings.ilike(body.current_thread.text,
                          "*picture*",
                          "*photo*",
                          "*image*",
                          "*sad news*",
                          "*sad announcement*",
                          "*sad update*",
                          "*new pics*",
                          "*back memories*",
                          "*any memories*",
                          "*old memories*",
                          "*evoke memories*",
                          "*bittersweet memories*"
        )
      )
    )
    or (
      body.plain.raw is not null
      and body.html.display_text is null
      and (
        length(body.current_thread.text) == 0
        or (
          length(body.current_thread.text) < 500
          // fake forward indicator in the plain text body
          and (
            regex.contains(body.plain.raw,
                           'On (Sunday|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday).{0,50} wrote'
            )
            or strings.icontains(body.plain.raw, 'Original Message')
          )
          and not regex.contains(body.current_thread.text,
                                 'On (Sunday|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday).{0,50} wrote'
          )
          and not strings.icontains(body.current_thread.text,
                                    'Original Message'
          )
          and not any(headers.hops, any(.fields, .name == "Resent-From"))
        )
      )
      and strings.ilike(body.plain.raw,
                        "*picture*",
                        "*photo*",
                        "*image*",
                        "*sad news*",
                        "*sad announcement*",
                        "*sad update*",
                        "*pics*",
                        "*back memories*",
                        "*any memories*",
                        "*old memories*",
                        "*evoke memories*",
                        "*bittersweet memories*"
      )
      and not strings.istarts_with(body.plain.raw, "[cid:image")
      and strings.icontains(subject.subject, sender.display_name)
    )
    or (
      strings.icontains(subject.subject, sender.display_name)
      and sender.email.domain.root_domain in $free_email_providers
      and length(body.links) == 2
      and length(filter(body.links, .display_text == "h")) == 1
      and length(filter(body.links, .display_url.scheme == "ttp")) == 1
    )
  )
  and length(body.links) < 5
  and any(body.links,
          (
            (
              network.whois(.href_url.domain).days_old < 30
              or network.whois(.display_url.domain).days_old < 30
              or not network.whois(.href_url.domain).found
              or network.whois(.href_url.domain).found is null
            )
            and .href_url.domain.root_domain != sender.email.domain.root_domain
          )
          or (
            length(.display_text) == 1
            and .href_url.domain.root_domain in ("facebook.com", "youtube.com")
          )
          or (
            // random 5-6 character subdomain
            regex.icontains(.href_url.domain.domain,
                            '^[a-z]{5,6}\.[a-z]{5,}\.[a-z]+'
            )
            // subdomain contains 3+ consecutive consonants
            and regex.icontains(.href_url.domain.domain,
                                '^[a-z]*[b-df-hj-np-tv-z]{3,}[a-z]*\.'
            )
            and network.whois(.href_url.domain).days_old < 365
          )
  )
)
and (
  (
    (length(headers.references) > 0 or headers.in_reply_to is null)
    and not (
      (
        strings.istarts_with(subject.subject, "RE:")
        or strings.istarts_with(subject.subject, "R:")
        or strings.istarts_with(subject.subject, "ODG:")
        or strings.istarts_with(subject.subject, "答复:")
        or strings.istarts_with(subject.subject, "AW:")
        or strings.istarts_with(subject.subject, "TR:")
        or strings.istarts_with(subject.subject, "FWD:")
        or regex.imatch(subject.subject, '(\[[^\]]+\]\s?){0,3}(re|fwd?)\s?:')
      )
    )
  )
  or length(headers.references) == 0
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and sender.email.domain.root_domain == "firebaseapp.com"
and length(filter(body.links,
                  .href_url.domain.root_domain not in ("aka.ms")
                  and .href_url.path is not null
           )
) == 1
and any(body.links,
        .href_url.domain.domain == sender.email.domain.domain
        and .href_url.path == "/__/auth/action"
        and any(.href_url.query_params_decoded["mode"], . == "resetPassword")
)
and (
  (
    not profile.by_sender().solicited
    and profile.by_sender().prevalence == "new"
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
  or not headers.auth_summary.dmarc.pass
)

type.inbound
and length(body.current_thread.text) < 1500
and (
  // Ghostwriting and book-related terms in subject
  strings.icontains(subject.subject, "book project")
  or strings.icontains(subject.subject, "ghostwriting")
  or strings.icontains(subject.subject, "becoming an author")
  or strings.icontains(subject.subject, "your book")
  or strings.icontains(subject.subject, "writing project")
  or strings.icontains(subject.subject, "publish")
  or strings.icontains(subject.subject, " author ")

  // Body contains ghostwriting service offers
  or strings.icontains(body.current_thread.text, "ghostwriting")
  or strings.icontains(body.current_thread.text, "ghostwriter")
  or strings.icontains(body.current_thread.text, "writing firm")
  or strings.icontains(body.current_thread.text, "book writing")
  or strings.icontains(body.current_thread.text, "publishing")
)
// Common scam language patterns
and (
  (
    strings.icontains(body.current_thread.text, "complimentary")
    and (
      strings.icontains(body.current_thread.text, "sample")
      or strings.icontains(body.current_thread.text, "chapter")
      or strings.icontains(body.current_thread.text, "consultation")
    )
  )
  or (
    strings.icontains(body.current_thread.text, "fascinated")
    and strings.icontains(body.current_thread.text, "what you have done")
  )
  or strings.icontains(body.current_thread.text, "inspiring stories")
  or strings.icontains(body.current_thread.text, "gather some information")
  or strings.icontains(body.current_thread.text, "few minutes of your time")
  or strings.icontains(body.current_thread.text, "absolutely no obligation")
  or strings.icontains(body.current_thread.text, "writing team")
)
and not (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name in (
        "Newsletters and Digests",
        "Events and Webinars",
        "Educational and Research",
        "Financial Communications",
        "Advertising and Promotions",
        "Legal and Compliance",
        "Professional and Career Development"
      )
      and .confidence == "high"
  )
)

// Standard negations
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)