Brand impersonation: Trust Wallet

type.inbound
and length(body.links) > 0
and (
  regex.icontains(strings.replace_confusables(sender.display_name),
                  '\btrust wa[li1]{2}et\b'
  )
  or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
                          'trust wallet'
  ) <= 2
)
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name in ("cred_theft", "callback_scam", "steal_pii", "extortion")
      and .confidence in ("high")
  )
)
and sender.email.domain.root_domain not in~ ('trustwallet.com')

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().any_messages_benign