Service abuse: Amazon invitation with suspected callback phishing

type.inbound
and sender.email.email == 'no-reply@amazon.com'
and subject.base == 'Your invitation has been sent'
and any(html.xpath(body.html, "//h2[contains(@class, 'rio-header')]").nodes,
        // phone number regex
        regex.icontains(strings.replace_confusables(.display_text),
                        '\+?(?:[ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                        '\+?(?:[ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
        )
)