Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited)

type.inbound
and any(recipients.to, .email.email == sender.email.email)
and length(recipients.cc) == 0
and length(recipients.bcc) == 0
and length(body.links) == 0
and any(headers.reply_to,
        .email.domain.domain in $free_email_providers
        and not .email.domain.domain == sender.email.domain.domain
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)