Link: Multistage landing - Trello board abuse

type.inbound
and any(filter(body.links,
               .href_url.domain.root_domain == "trello.com"
               and strings.istarts_with(.href_url.path, "/b/")
        ),
        // avoid doing LinkAnalysis if the display-text has strong indications of phishing
        (
          // replace confusables - observed ITW
          regex.icontains(strings.replace_confusables(.display_text),
                          'review|proposal|document|efax|restore|[o0]pen|secure|messaging|reset|account|verify|login|notification|alert|urgent|immediate|access|support|\bupdate\b|download|attachment|service|payment|remittance|invoice|rfp|rfi|pdf|doc'
          )
          and not regex.icontains(strings.replace_confusables(.display_text),
                                  'customer service'
          )
          // add confidence to these strings by using profile.by_sender()
          and (
            not profile.by_sender_email().solicited
            and profile.by_sender_email().prevalence in ('new', 'outlier')
          )
        )
        or any(ml.link_analysis(.).additional_responses,
               // make sure we have a valid response first
               .json is not null
               and .status_code == 200
               and (
                 // less than 4 cards on the Trello board
                 (
                   .json['cards'] is not null
                   and (
                     length(.json['cards']) < 4
                     or any(.json['cards'],
                            // suspicious link in a card title
                            (
                              strings.parse_url(.['name']).domain.valid
                              and (
                                ml.link_analysis(strings.parse_url(.['name'])).credphish.disposition == "phishing"
                                or ml.link_analysis(strings.parse_url(.['name'])
                                ).credphish.contains_captcha
                                // CF Turnstile
                                or any(ml.link_analysis(strings.parse_url(.['name']
                                                        )
                                       ).unique_urls_accessed,
                                       .domain.domain == "challenges.cloudflare.com"
                                )
                              )
                            )
                            // Trello detected a malicious card attachment
                            or .['badges']['maliciousAttachments'] > 0
                     )
                   )
                 )
                 // Trello has blocked the user account
                 or any(.json['members'], .['activityBlocked'] == true)
                 // the user is the sole member of their Trello account and is the admin
                 or (
                   length(.json['organization']['memberships']) == 1
                   and all(.json['organization']['memberships'],
                           .['memberType'] == "admin"
                   )
                 )
               )
        )
)