BEC/Fraud: Fake investment outreach from suspicious TLD

type.inbound
// subject contains investment language
and (
  strings.istarts_with(subject.base, 'financing for', 'investment into')
  or strings.icontains(subject.base, "family office")
)

// financial body content
and (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name == "Financial Communications" and .confidence != "low"
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "B2B Cold Outreach" and .confidence != "low"
    )
    and regex.icontains(body.current_thread.text,
                        'funding',
                        'capital',
                        '\d{3}k',
                        'rates from \d+%',
                        'funded in \d+',
                        'family office'
    )
  )
)

// suspicious sender
and (
  sender.email.domain.tld in $suspicious_tlds
  or sender.email.domain.tld == "info"
)