Brand impersonation: FedEx

type.inbound
and (
  sender.display_name in~ ('fedex', 'fedex shipment', 'fedex tracking updates')
  or strings.ilevenshtein(sender.display_name, 'fedex') <= 1
  or regex.icontains(sender.display_name, '^Fed-?ex')
  or strings.ilike(sender.email.domain.domain, '*fedex*')
)

and sender.email.domain.root_domain not in~ (
  'fedex.com',
  'cj.com', // CJ is a global affiliate marketing network
  'sedex.com', // sedex.com is not affiliated with FedEx, but is an apparent FP
  'myworkday.com',
  'billtrust.com',
  'flying-cargo.rs', // Serbian arm of Fedex (https://www.fedex.com/en-rs/customer-support.html)
  'confirmit.com', // survey/market research company
  'centercode.com' // survey company
)
and (
  not profile.by_sender().any_messages_benign
  and not profile.by_sender().solicited
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)