Brand impersonation: FINRA

type.inbound
and (
  strings.ilevenshtein(sender.display_name, 'finra') <= 1
  or strings.ilevenshtein(sender.email.domain.sld, 'finra') <= 1
)
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "financial"
)
and length(ml.nlu_classifier(body.current_thread.text).intents) > 0
and sender.email.domain.root_domain not in~ (
  'finra.org',
  'finrax.com',
  'finca.wine', // a wine company
  'finta.com' // unrelated domain caught by levenshtein 
)
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)