Brand impersonation: Paperless Post

type.inbound
and strings.contains(body.html.raw, 'ppassets.com')
and length(filter(html.xpath(body.html, '//img/@src').nodes,
                  // calling parse_url allows url decoding to help us
                  strings.parse_url(.raw).domain.root_domain == 'ppassets.com'
           )
) >= 2
and length(filter(body.links,
                  .href_url.domain.domain == "links.paperlesspost.com"
                  or (
                    .href_url.domain.root_domain == "paperlesspost.com"
                    and strings.istarts_with(.href_url.path, '/go/')
                  )
           )
) < 2
and not (
  (subject.is_forward or subject.is_reply)
  and (
    (length(headers.references) != 0 or headers.in_reply_to is not null)
    or length(body.previous_threads) > 0
  )
)
and not (
  sender.email.domain.root_domain == "paperlesspost.com"
  and headers.auth_summary.dmarc.pass
)