Brand impersonation: Bluehost

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name in ("sender", "org") and strings.icontains(.text, 'bluehost')
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)
and not (
  sender.email.domain.root_domain in (
    "bluehost.com",
    "bluehost.in",
    "newfold.com",
    "ccsend.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)