Brand impersonation: Federal court system

type.inbound
and (
  (
    any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "sender"
        and regex.icontains(.text,
                            '(?:U\.?S\.?|United States)\s*(?:District\s+)?Courts?\b'
        )
    )
    and any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "cred_theft" and .confidence != "low"
    )
  )
  or 2 of (
    strings.icontains(body.current_thread.text, "PACER"),
    // real PACER Service Center phone number
    strings.icontains(body.current_thread.text, "1-800-676-6856"),
    strings.icontains(body.current_thread.text, "contempt charges"),
    strings.icontains(body.current_thread.text, "Official Court Notice"),
    regex.icontains(body.current_thread.text, '(?:jury summons|juror number)'),
    strings.icontains(body.current_thread.text,
                      'complaint has been filed against you'
    )
  )
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "Newsletters and Digests" and .confidence == "high"
)
// negate the actual federal judiciary unless it fails DMARC authentication
and not (
  sender.email.domain.tld == "gov"
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)