Brand impersonation: Exodus

type.inbound
and (
  strings.ilike(sender.display_name, "*exodus*")
  or (
    strings.ilike(sender.email.domain.root_domain, "*exodus*")
    and network.whois(sender.email.domain).days_old <= 30
  )
)
and sender.email.domain.root_domain not in (
  "exodus.com",
  "exodus.io",
  "exodusescaperoom.com"
)
and sender.email.email not in $recipient_emails
and (
  any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")
  or any(ml.nlu_classifier(body.current_thread.text).entities,
         .text == "wallet"
  )
)