Impersonation: Legal firm with copyright infringement notice

type.inbound
and length(body.previous_threads) == 0
and length(body.current_thread.text) < 5000
and 0 < length(body.links) < 10

// common strings in subject or base
and (
  2 of (
    strings.ilike(subject.base, '*Content*'),
    strings.ilike(subject.base, '*Compliance*'),
    strings.ilike(subject.base, '*Review*'),
    strings.ilike(subject.base, '*Legal*'),
    strings.ilike(subject.base, '*Formal*'),
    strings.ilike(subject.base, '*LLP*'),
    strings.ilike(subject.base, '*Unauthorized*'),
    strings.ilike(subject.base, '*Trademark*'),
    strings.ilike(subject.base, '*Law*'),
    strings.ilike(subject.base, '*Enforcement*'),
    strings.ilike(subject.base, '*Copyright*'),
    strings.ilike(subject.base, '*Violat*'),
    strings.ilike(subject.base, '*Intellectual*'),
    strings.ilike(subject.base, '*Concerning*'),
    strings.ilike(subject.base, '*Notice*'),
    strings.ilike(subject.base, '*Clarification*'),
    strings.ilike(subject.base, '*Matter*'),
    strings.ilike(sender.display_name, '*Content*'),
    strings.ilike(sender.display_name, '*Copyright*'),
    strings.ilike(sender.display_name, '*Review*'),
    strings.ilike(sender.display_name, '*Legal*'),
    strings.ilike(sender.display_name, '*Investigation*'),
    strings.ilike(sender.display_name, '*LLP*'),
    strings.ilike(sender.display_name, '*Law*'),
    strings.ilike(sender.display_name, '*Intellectual*'),
    strings.ilike(sender.display_name, '*Notice*'),
    strings.ilike(sender.display_name, '*Matter*')
  )
)

// common strings in email current thread
and 15 of (
  strings.ilike(body.current_thread.text, '*copyright*'),
  strings.ilike(body.current_thread.text, '*trademark*'),
  strings.ilike(body.current_thread.text, '*inquiry*'),
  strings.ilike(body.current_thread.text, '*online*'),
  strings.ilike(body.current_thread.text, '*authorized*'),
  strings.ilike(body.current_thread.text, '*legal*'),
  strings.ilike(body.current_thread.text, '*represent*'),
  strings.ilike(body.current_thread.text, '*lawful*'),
  strings.ilike(body.current_thread.text, '*owner*'),
  strings.ilike(body.current_thread.text, '*materials*'),
  strings.ilike(body.current_thread.text, '*protected*'),
  strings.ilike(body.current_thread.text, '*infring*'),
  strings.ilike(body.current_thread.text, '*immediate*'),
  strings.ilike(body.current_thread.text, '*cessation*'),
  strings.ilike(body.current_thread.text, '*content*'),
  strings.ilike(body.current_thread.text, '*referenced*'),
  strings.ilike(body.current_thread.text, '*17 U.S.C. §*'),
  strings.ilike(body.current_thread.text, '*constitutes*'),
  strings.ilike(body.current_thread.text, '*authorization*'),
  strings.ilike(body.current_thread.text, '*removal*'),
  strings.ilike(body.current_thread.text, '*comply*'),
  strings.ilike(body.current_thread.text, '*failure*'),
  strings.ilike(body.current_thread.text, '*law firm*'),
  strings.ilike(body.current_thread.text, '*LLP*'),
  strings.ilike(body.current_thread.text, '*compliance*'),
  strings.ilike(body.current_thread.text, '*cease*'),
  strings.ilike(body.current_thread.text, '*protect*'),
  strings.ilike(body.current_thread.text, '*rights*'),
  strings.ilike(body.current_thread.text, '*penalty*'),
  strings.ilike(body.current_thread.text, '*perjury*'),
  strings.ilike(body.current_thread.text, '*holder*'),
  strings.ilike(body.current_thread.text, '*declare*'),
  strings.ilike(body.current_thread.text, '*sworn*'),
  strings.ilike(body.current_thread.text, '*affidavit*'),
  strings.ilike(body.current_thread.text, '*investigation*'),
  strings.ilike(body.current_thread.text, '*identified*'),
  strings.ilike(body.current_thread.text, '*reproduction*'),
  strings.ilike(body.current_thread.text, '*license*'),
  strings.ilike(body.current_thread.text, '*granted*'),
  strings.ilike(body.current_thread.text, '*permitting*'),
  strings.ilike(body.current_thread.text, '*evidence*'),
  strings.ilike(body.current_thread.text, '*proceedings*'),
  strings.ilike(body.current_thread.text, '*evidentiary*'),
  strings.ilike(body.current_thread.text, '*remove*'),
  strings.ilike(body.current_thread.text, '*suspend*'),
  strings.ilike(body.current_thread.text, '*discontinue*'),
  strings.ilike(body.current_thread.text, '*72 hours*'),
  strings.ilike(body.current_thread.text, '*48 hours*'),
  strings.ilike(body.current_thread.text, '*24 hours*'),
  strings.ilike(body.current_thread.text, '*proof*'),
  strings.ilike(body.current_thread.text, '*unresolved*'),
  strings.ilike(body.current_thread.text, '*accordance*'),
  strings.ilike(body.current_thread.text, '*procedures*'),
  strings.ilike(body.current_thread.text, '*interests*'),
  strings.ilike(body.current_thread.text, '*appeal*'),
  strings.ilike(body.current_thread.text, '*clarification*'),
  strings.ilike(body.current_thread.text, '*notice*')
)

// remove phrase from legitimate complaint
and not regex.icontains(body.current_thread.text,
                        '(?:we are passing the notice below|content has been removed|removed from our website|notice of intended action|I have not granted|I am the original creator|content you reported has been removed|complaint will be carefully reviewed|provide a list of violations|document confirming your right to act)'
)

// not copyright reports
and not regex.icontains(body.current_thread.text,
                        '(?:confirmation|received).{0,100}copyright report'
)

// verified dmca receiving/sending address
and not any([recipients.cc, recipients.to, recipients.bcc],
            any(.,
                .email.email in (
                  'dmca@vimeo.com',
                  'dmca@support.epicgames.com',
                  'takedowns@doppel.com',
                  'ipenforcement@epicgames.com'
                )
            )
)
and not strings.icontains(sender.email.domain.root_domain, 'edwinjamesip.com')