Brand impersonation: DigitalOcean

type.inbound
and (
  sender.display_name =~ 'digitalocean'
  or strings.ilevenshtein(sender.display_name, 'digitalocean') <= 2
  or strings.ilike(sender.email.domain.domain, '*digitalocean*')
)
and sender.email.domain.root_domain not in (
  'digitalocean.com',
  'paperspace.com',
  'coupahost.com' // third party supplier used by DigitalOcean 
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign