Service abuse: Square marketing with suspicious QR code

type.inbound
and sender.email.domain.domain == "squaremktg.com"
and beta.scan_qr(file.message_screenshot()).found
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any(filter(beta.scan_qr(file.message_screenshot()).items,
               // ignore square's own free website hosting service
               .url.domain.root_domain != "square.site"
        ),
        (
          .url.domain.root_domain in $self_service_creation_platform_domains
          or .url.domain.domain in $self_service_creation_platform_domains
        )
        or (
          .url.domain.root_domain in $free_file_hosts
          or .url.domain.domain in $free_file_hosts
        )
)