This rule detects inbound email-based fraud campaigns that originate from domains registered within the last 180 days and are designed to solicit investment interest from named organizations or individuals on behalf of a purported private family office. Attackers use financial-sounding sender names and rotate first names and target company names while preserving a nearly identical subject line structure to evade simple checks. The outreach aims to elicit a response and appears as a legitimate investment inquiry. Detection combines content and sender intelligence: it requires an inbound message, a Whois check confirming domain age under 180 days, and an inline content scan for monetary references. The monetary mention is detected with a case-insensitive regex that looks for patterns like a dollar amount followed by another dollar amount and a magnitude such as million. The rule flags patterns in body HTML text or subject lines and uses content analysis, sender/domain analysis, and Whois to identify potential BEC/fraud and spam campaigns. Severity is medium, reflecting the risk level of social engineering scams that may lead to financial loss or information disclosure.