Brand Impersonation: Mailgun

type.inbound
and (
  any([
        sender.display_name,
        sender.email.domain.domain,
        sender.email.local_part,
        subject.subject
      ],
      regex.icontains(strings.replace_confusables(.), "ma[il][il]gun")
  )
  or regex.icontains(body.html.raw, 
    '<title>.*mailgun.*</title>', 'alt\s*=\s*"\s*Mailgun\s*Logo\s*"'
  )
  or regex.icontains(body.current_thread.text,
                     '[©®]\s*(20\d\d\s*)?Mailgun',
                     'mailgun\s*[©®]'
  )
  or any(ml.logo_detect(beta.message_screenshot()).brands,
         .name == "Mailgun" and .confidence in ("medium", "high")
  )
)
and not (
  // sent from mailgun actual
  (
    sender.email.domain.root_domain in (
      'mailgun.com',
      'mailgun.net', // official mailgun domains
      'sinch.com', // parent company of Mailgun
      'mailgunwarmup.com', // an unrelated b2b firm
      'emailonacid.com', // another sinch email product 
      'elior-na.com', // a domain with a simliar logo that catches on logo_detect
      'brembo.com' // a domain with a simliar logo that catches on logo_detect
    )
    and headers.auth_summary.dmarc.pass
  )
  // and not where the recipient include the domain with a simliar logo
  // and where that recipient shows up in a previous thread
  or (
    any(recipients.to, .email.domain.root_domain in ("elior-na.com", "brembo.com"))
    and any(filter(recipients.to, .email.domain.root_domain in ("elior-na.com", "brembo.com")),
            (
                strings.icontains(body.html.display_text, strings.concat("From: ", .email.email))
                or strings.icontains(body.html.display_text, strings.concat("From: ", .display_name))
            )
    )
  )
  or 
  // some domains have "mailgun" as a subdomain and are sent via mailgun
  // these are unlikely to be impersonations
  (
    (
      strings.icontains(sender.email.domain.domain, "mailgun")
      or strings.icontains(sender.email.local_part, "mailgun")
    )
    and (
      // if mailgun action was in the header.hops very likely not impersonation
      any(headers.domains, .root_domain in ('mailgun.com', 'mailgun.net'))
      // but if not and there are 4 or more X-Mailgun headers, likely not impersonation
      or sum(map(filter(headers.hops, .index < 2),
                 length(filter(.fields,
                               strings.starts_with(.name, "X-Mailgun-")
                        )
                 )
             )
      ) >= 3
    )
  )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)