Domain impersonation: Freemail reply-to local lookalike with financial request

type.inbound
and any(headers.reply_to,
        .email.email != sender.email.email
        and .email.domain.domain in $free_email_providers
        and .email.email not in $sender_emails
        and strings.contains(.email.local_part, sender.email.domain.sld)
)
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "bec" and .confidence in ("medium", "high")
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "financial"
    )
    and any(ml.nlu_classifier(body.current_thread.text).entities,
            .name == "request"
    )
    and any(ml.nlu_classifier(body.current_thread.text).entities,
            .name == "urgency"
    )
    and any(ml.nlu_classifier(body.current_thread.text).entities,
            .name == "sender"
    )
    and any(ml.nlu_classifier(body.current_thread.text).intents,
            .name != "benign"
    )
  )
)