BEC/Fraud: Fake investment outreach from suspicious TLD

type.inbound
// subject contains investment language
and (
  strings.istarts_with(subject.base,
                       'financing for',
                       'investment into',
                       'an investment opportunity',
                       'investing in'
  )
  or any([subject.base, body.current_thread.text],
         regex.icontains(., 'family.?office')
  )
)
// financial body content
and (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name == "Financial Communications" and .confidence != "low"
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "B2B Cold Outreach" and .confidence != "low"
    )
    and regex.icontains(body.current_thread.text,
                        'funding',
                        'capital',
                        '\d{3}k',
                        'rates from \d+%',
                        'funded in \d+',
                        'family office'
    )
  )
)
// suspicious sender
and (
  sender.email.domain.tld in $suspicious_tlds
  or sender.email.domain.tld in ("info", "de")
)