Brand impersonation: Stripe notification

type.inbound
and (
  strings.ilike(sender.display_name, 'stripe*')
  or strings.ilevenshtein(sender.display_name, 'stripe') <= 1
  or strings.ilike(sender.email.domain.domain, '*stripe*')
)
and (
  any(body.links,
      (
        .display_text in~ ("view in dashboard")
        or (
          network.whois(.href_url.domain).days_old < 30
          and regex.icontains(.display_text, 'view|click|dashboard|portal')
        )
      )
      and .href_url.domain.root_domain != "stripe.com"
  )
  // if it's a well done fake payment notification, the only 2 links that aren't from Stripe
  // are the customer's email address and the CTA button (view in dashboard, click for more info, etc.)
  or (
    length(filter(body.links,
                  .href_url.domain.root_domain != 'stripe.com'
                  and .display_text is not null
           )
    ) == 2
    and length(body.links) > 2
  )
)
and not (
  sender.email.domain.root_domain in ("stripe.com", "pinstripes.com")
  and headers.auth_summary.dmarc.pass
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign