Brand impersonation: MetaMask

type.inbound
and length(body.links) > 0
and (
  regex.icontains(strings.replace_confusables(sender.display_name),
                  '\bmetamask\b',
                  '\bmetamask\.io\b'
  )
  or strings.contains(strings.replace_confusables(sender.display_name),
                      "METAMASK"
  )
  or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
                          'metamask'
  ) <= 2
  or any(ml.nlu_classifier(body.current_thread.text).entities,
         (.name == "sender" and strings.icontains(.text, 'metamask'))
         or (.name == "org" and regex.imatch(.text, '\bmetamask\s+\w+'))
  )
)
and (
  any(ml.logo_detect(file.message_screenshot()).brands, .name == "MetaMask")
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name in ("cred_theft", "callback_scam", "steal_pii")
         and .confidence in ("high")
  )
)
and sender.email.domain.root_domain not in~ ('metamask.io')

// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not profile.by_sender().any_messages_benign