Domain impersonation: Freemail reply-to local lookalike with financial request

type.inbound
and any(headers.reply_to,
        .email.email != sender.email.email
        and .email.domain.domain in $free_email_providers
        and .email.email not in $sender_emails
        and strings.contains(.email.local_part, sender.email.domain.sld)
)
and (
  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec" and .confidence in ("medium", "high"))
      or (
        any(ml.nlu_classifier(body.current_thread.text).entities, .name == "financial")
        and any(ml.nlu_classifier(body.current_thread.text).entities, .name == "request")
        and any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency")
        and any(ml.nlu_classifier(body.current_thread.text).entities, .name == "sender")
        and any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")
      )
)