This rule detects inbound messages that abuse Zohodesk infrastructure by using a reply-to address outside zohodesk.com, combined with NLP or text cues indicating a job scam. It targets messages where the sender domain is zohodesk.com, but the Reply-To header points to a non-Zohodesk domain, signaling potential BEC/spam with an out-of-band pivot. The detection requires: (1) inbound message context, (2) sender domain = zohodesk.com, (3) a reply-to header pointing to an external domain, and (4) NLP-derived signal of a job scam (intent name "job_scam" with non-low confidence) or a fallback keyword cue such as the phrase "talent acquisition" in the thread body. This leverages header analysis and sender analysis in combination with natural language understanding to identify credible-looking but malicious replies that redirect responses to external actors. The rule flags these as potential abuse of legitimate Zohodesk services for deception. Attacker techniques include social engineering (to appear legitimate via an established service), spoofing (via reply-to header manipulation), and out-of-band pivoting (redirecting replies). Attack types include BEC/Fraud and Spam. The rule uses: inbound type gating (type.inbound), validation of zohodesk.com as the sender domain, any(headers.reply_to, external domain check), and combined NLP/search signals (NLU intent "job_scam" with adequate confidence or the keyword "talent acquisition"). Potential false positives may occur if legitimate messages legitimately use external reply-to addresses or contain generic phrases; tuning may be required in environments with legitimate cross-domain reply behavior.