Service abuse: Meetup.com redirect with brand impersonation

type.inbound
// we check 'body links' as this campaign has been observed abusing fake threads
and any(body.links,
        .href_url.domain.domain == "clicks.meetup.com"
        // lengthy url hints at redirect the circus that occurs
        and length(.href_url.url) > 300
)
// negate legit meetup.com by checking for their logo
and not any(html.xpath(body.html, '//img/@src').nodes,
            strings.icontains(.raw, 'meetupstatic')
)
// negate high trust senders that pass auth
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)