Brand impersonation: DHL

type.inbound
and (
  regex.icontains(sender.display_name, '\bDHL\b')
  or (
    strings.ilike(sender.email.domain.domain, '*DHL*')
    and length(sender.email.domain.domain) < 15
  )
  or strings.ilike(subject.subject, '*DHL notification*')
  or regex.icontains(subject.subject, 'dhl? express')
  or regex.contains(subject.subject, '\bD.{0,2}H.{0,2}L.{0,2}\b')
  or (
    any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "Shipping and Package" and .confidence == "high"
    )
    and strings.contains(body.current_thread.text, 'DHL ')
  )
)
and (
  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency")
  or any(ml.nlu_classifier(body.current_thread.text).entities,
         .name == "org"
         and (
           .text =~ "DHL"
           or .text =~ "DHL Express"
           or strings.istarts_with(.text, "DHL International")
         )
  )
  or any(ml.logo_detect(file.message_screenshot()).brands,
         .name == "DHL" and .confidence in ("medium", "high")
  )
  or regex.icontains(body.current_thread.text, '\bDHL\b')
  // it contains a QR code
  or (
    //
    // This rule makes use of a beta feature and is subject to change without notice
    // using the beta feature in custom rules is not suggested until it has been formally released
    //
    beta.scan_qr(file.message_screenshot()).found
    and any(beta.scan_qr(file.message_screenshot()).items, .type == "url")
  )
  //
  // This rule makes use of a beta feature and is subject to change without notice
  // using the beta feature in custom rules is not suggested until it has been formally released
  //
  or strings.ilike(beta.ocr(file.message_screenshot()).text,
                   "*package*",
                   "*parcel*",
                   "*shipping*",
                   "*delivery*",
                   "*track*"
  )
  or strings.ilike(body.current_thread.text,
                   "*package*",
                   "*parcel*",
                   "*shipping*",
                   "*delivery*",
                   "*track*"
  )
)
and (
  (
    (length(headers.references) > 0 or headers.in_reply_to is null)
    and not (
      (
        strings.istarts_with(subject.subject, "RE:")
        or strings.istarts_with(subject.subject, "RES:")
        or strings.istarts_with(subject.subject, "R:")
        or strings.istarts_with(subject.subject, "ODG:")
        or strings.istarts_with(subject.subject, "答复:")
        or strings.istarts_with(subject.subject, "AW:")
        or strings.istarts_with(subject.subject, "TR:")
        or strings.istarts_with(subject.subject, "FWD:")
        or regex.imatch(subject.subject, '(\[[^\]]+\]\s?){0,3}(re|fwd?)\s?:')
      )
    )
  )
  or length(headers.references) == 0
)
and sender.email.domain.root_domain not in~ (
  'dhl.com',
  'dhl-news.com',
  'bdhllp.com',
  'dhlecommerce.co.uk',
  'dhlparcel.co.uk',
  'dhlecs.com',
  'dhl.co.uk',
  'dhl.co.tz',
  'dpdhl.com',
  'dhl.de',
  'dhl.fr',
  'dhl.pl',
  'dhlexpress.fr', // legit dhl site
  'dhlending.com',
  'inmotion.dhl',
  'dhlparcel.nl',
  'dhltariff.co.uk',
  'dhlindia-kyc.com',
  'dpogroup.com',
  '4flow-service.com', // shipping service
  'leaders-in-logistics.com', // legit sight for leadership webinar events
  'deutschepost.de', // German postal service
  'dhlecommerce.nl',
  'dhl.nl',
  'adhlawfirm.com', // similar name but unrelated
  'attendhlth.com', // dhl in domain but unrelated
  'tdhlaw.com', // dhl in domain but unrelated
  'hapibenefits.com', // DHL rewards program
  'dhlgpi.com', // DHL Australia
  'dhlfreight-news.com'
)
and not (
  sender.email.domain.tld in ('dhl')
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)