Brand impersonation: MetaMask

type.inbound
and length(body.links) > 0
and (
  regex.icontains(strings.replace_confusables(sender.display_name),
                  '\bmetamask\b',
                  '\bmetamask\.io\b'
  )
  or strings.contains(strings.replace_confusables(sender.display_name),
                      "METAMASK"
  )
  or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
                          'metamask'
  ) <= 2
)
and (
  any(ml.logo_detect(file.message_screenshot()).brands, .name == "MetaMask")
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name in ("cred_theft", "callback_scam", "steal_pii")
         and .confidence in ("high")
  )
)
and sender.email.domain.root_domain not in~ ('metamask.io')

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().any_messages_benign