VIP impersonation: Fake thread with display name match, email mismatch

type.inbound
and any($org_vips,
        strings.icontains(body.html.display_text,
                          strings.concat("From: ", .display_name, " <")
        )
        and not strings.icontains(body.html.display_text,
                              strings.concat("From: ",
                                             .display_name, " <",
                                             .email, ">"
                              )
        )
)
and any([body.current_thread.text, body.html.display_text, body.plain.raw],
        3 of (
          strings.icontains(., "from:"),
          strings.icontains(., "to:"),
          strings.icontains(., "sent:"),
          strings.icontains(., "date:"),
          strings.icontains(., "cc:"),
          strings.icontains(., "subject:")
        )
)
and (
  length(headers.references) == 0
  or headers.in_reply_to is null
)
and (
  network.whois(sender.email.domain).days_old < 90
  or profile.by_sender().days_known == 0
)
and not profile.by_sender().solicited