ClickFunnels link infrastructure abuse

type.inbound
and (
  (
    length(body.links) < 15
    and any(body.links, .href_url.domain.root_domain == "myclickfunnels.com")
  )
  or (
    length(attachments) <= 3
    and (
      any(attachments,
          (.file_type in $file_types_images or .file_type == "pdf")
          and any(file.explode(.),
                  .scan.qr.type is not null
                  and .scan.qr.url.domain.root_domain == "myclickfunnels.com"
                  // exclude images taken with mobile cameras and screenshots from android
                  and not any(.scan.exiftool.fields,
                              .key == "Model"
                              or (
                                .key == "Software"
                                and strings.starts_with(.value, "Android")
                              )
                  )
                  // exclude images taken with mobile cameras and screenshots from Apple
                  and not any(.scan.exiftool.fields,
                              .key == "DeviceManufacturer"
                              and .value == "Apple Computer Inc."
                  )
          )
      )
      or (
        length(attachments) == 0
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and beta.parse_exif(file.message_screenshot()).image_height < 2000
        and beta.parse_exif(file.message_screenshot()).image_width < 2000
        and any(beta.scan_qr(file.message_screenshot()).items,
                .type is not null
                and .url.domain.root_domain == "myclickfunnels.com"
        )
      )
    )
  )
  or (
    length(attachments) <= 3
    and (
      any(attachments,
          (
            .file_type in ("pdf")
            or .file_extension in ("pdf", "eml")
            or .file_extension in $file_extensions_macros
            or (
              .content_type in ("message/rfc822") or .file_extension in ('eml')
            )
          )
          and any(file.explode(.),
                  any(.scan.url.urls,
                      .domain.root_domain == "myclickfunnels.com"
                  )
          )
      )
    )
  )
)
and not (
  any(headers.domains, strings.ends_with(.domain, "mailer.myclickfunnels.com"))
  or (
    any(headers.hops[0].authentication_results.dkim_details,
        .domain == "mailer.myclickfunnels.com"
    )
    and headers.hops[0].authentication_results.dmarc is not null
    and strings.iends_with(headers.hops[0].authentication_results.dmarc, "pass")
  )
)
// negating legit replies
and not (
  (
    strings.istarts_with(subject.subject, "RE:")
    or strings.istarts_with(subject.subject, "FW:")
    or strings.istarts_with(subject.subject, "FWD:")
    or strings.istarts_with(subject.subject, "Automatic reply:")
  )
  and (length(headers.references) > 0 and headers.in_reply_to is not null)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)