Cyrillic vowel substitution in subject or display name from unknown sender

type.inbound

// message contains between 1 and 9 links
and (
  0 < length(body.links) < 10
  or (
    length(body.links) == 0
    and length(attachments) > 0
    and body.current_thread.text == ""
  )
)

//  display name or subject contains Cyrillic vowels in addition to standard letters
and any([subject.subject, sender.display_name],
        regex.icontains(., '(а|е|и|о|у)') and regex.icontains(., '[a-z]')
)

// and the senders tld or return path is not "ru"
and not (
  sender.email.domain.tld == "ru" or headers.return_path.domain.tld == "ru"
)
// and the return path is not 'calendar-server.bounces.google.com'
and not headers.return_path.domain.domain == 'calendar-server.bounces.google.com'
and not headers.return_path.domain.domain == 'identity-reachout.bounces.google.com'
and not headers.return_path.domain.domain == 'bounce-sg.zoom.us'
and not headers.return_path.domain.domain == 'bounce.dataminr.com'
and not headers.return_path.domain.domain == 'mail-us.atlassian.net'

// the message is unsolicited and no false positives
and (
  not profile.by_sender().solicited
  or (
    length(headers.reply_to) > 0
    and all(headers.reply_to, .email.email not in $recipient_emails)
  )
)
and not profile.by_sender().any_messages_benign