Brand impersonation: Zoom (strict)

type.inbound
and (
  sender.display_name =~ 'zoom'
  or sender.display_name =~ 'zoom video communications, inc.'
  or sender.display_name =~ 'zoom call'
)
and sender.email.domain.root_domain not in (
  'zoom.us',
  'zuora.com',
  'zoomgov.com',
  'zoom.com'
)
and (
  // if this comes from a free email provider,
  // flag if org has never sent an email to sender's email before
  (
    sender.email.domain.root_domain in $free_email_providers
    and not profile.by_sender().solicited
  )
  // if this comes from a custom domain,
  // flag if org has never sent an email to sender's domain before
  or (
    sender.email.domain.root_domain not in $free_email_providers
    and not profile.by_sender().solicited
  )
)