Brand impersonation: United States Patent and Trademark Office

type.inbound
and (
  regex.icontains(strings.replace_confusables(coalesce(sender.display_name, '')),
                  '\buspto\b|patent and trademark office|Trademark Electronic Application System',
  )
  or strings.ilike(sender.email.domain.domain, '*uspto*')
)
and sender.email.domain.root_domain != 'uspto.gov'
and length(body.links) >= 1
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in (
              'Newsletters and Digests',
              'Advertising and Promotions',
              'Events and Webinars'
            )
            and .confidence == 'high'
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)