Brand impersonation: Silicon Valley Bank

type.inbound
and (
  regex.icontains(sender.email.domain.domain,
                  "(silicon(e)?.{0,10}(valley|bank)|svb)"
  )
  or strings.ilevenshtein(sender.display_name, 'svb') <= 1
)
and network.whois(sender.email.domain).days_old <= 30