Link: Abused Trac-link URL

type.inbound
and (
  // body links
  (
    any(body.current_thread.links,
        .href_url.domain.root_domain == "trac-link.com"
        and strings.istarts_with(.href_url.path, '/api/mail-track/link/')
    )
    // negate legitimate service traversal
    and not strings.icontains(body.html.raw,
                              'https://storage.googleapis.com/easymails'
    )
  )

  // attachment links
  or any(attachments,
         (.file_extension == "pdf" or .file_type == "pdf")
         and any(file.explode(.),
                 any(.scan.pdf.urls, .domain.root_domain == "trac-link.com")
         )
  )
)