This inbound rule detects brand impersonation of the United States Patent and Trademark Office (USPTO) in email messages by combining sender/subject cues, URL/link analysis, and behavior-based exclusions. It looks for display name variations created via confusable characters, or explicit USPTO terms (for example, uspto, patent and trademark office, or Trademark Electronic Application System) in a case-insensitive manner. It also flags messages whose sender domain contains uspto (ilike '*uspto*') but only when the root domain is not the official uspto.gov, reducing false positives from legitimate USPTO communications. A prerequisite for detection is at least one link present in the body, enabling link-based signaling. The rule further reduces noise by excluding messages whose current-thread text is classified with high confidence as newsletters, advertising, or events, preventing mislabeling of routine communications as impersonation. Additionally, if the sender domain is considered high-trust and DMARC passes, the message is ignored to avoid blocking legitimate mail from trusted sources. Detection methods combine content analysis, header analysis, natural language understanding (NLU), sender analysis, and URL analysis to identify impersonation attempts. The rule is designed to capture business email compromise (BEC) and fraud scenarios through brand impersonation and social engineering techniques. Relevant data sources include sender metadata, email body content (including linked URLs), and DMARC authentication results. Overall, the rule aims to balance proactive USPTO-brand impersonation detection with pragmatic exclusions to minimize false positives.