Brand impersonation: Hulu

type.inbound
and (
  regex.icontains(sender.display_name, '\bhulu\b')
  or (
    strings.ilevenshtein(sender.display_name, 'hulu') <= 1
    and not (
      // lulu.com is a self publisher
      sender.display_name =~ "lulu"
      and sender.email.domain.root_domain == "lulu.com"
    )
    and not (
      // hudu.com is an IT documentation management platform
      sender.display_name =~ "hudu"
      and sender.email.domain.root_domain == "hudu.com"
    )
  )
  or strings.ilike(sender.email.domain.domain, '*hulu*')
  or (
    (
      length(recipients.to) == 0
      or (
        all(recipients.to, .email.domain.valid == false)
        and all(recipients.cc, .email.domain.valid == false)
      )
    )
    and any(ml.logo_detect(file.message_screenshot()).brands,
            .name == "Hulu" and .confidence in ("medium", "high")
    )
  )
)
and (
  sender.email.domain.root_domain not in (
    'hulu.com',
    'hulumail.com',
    'hulu.jp',
    'hulu-japan.jp'
  )
  or (
    sender.email.domain.root_domain in (
      'hulu.com',
      'hulumail.com',
      'hulu.jp',
      'hulu-japan.jp'
    )
    and not headers.auth_summary.dmarc.pass
  )
)
and not profile.by_sender().solicited