This rule detects potential abuse of the Upwork platform by analyzing inbound communications that originate from Upwork’s root domain (upwork.com). It combines sender-domain validation with a natural language understanding (NLU) check on the thread body to identify a callback scam. Specifically, it triggers when: (1) the inbound message source matches the rule type.inbound, (2) the sender’s root domain equals “upwork.com”, and (3) the NLU classifier applied to the thread text (body.current_thread.text) returns an intent named “callback_scam” with a confidence level that is not “low” (i.e., medium or high). This combination indicates the platform is being abused to entice recipients to call a fraudulent number, aligning with callback phishing techniques and social engineering tactics that may facilitate an out-of-band pivot to a malicious contact channel. The rule’s detection methods rely on Natural Language Understanding to assess intent and on sender analysis to corroborate domain authenticity. The rule is categorized as medium severity, reflecting a meaningful risk without an automatic assume-malicious reach across all Upwork interactions. Potential false positives could occur with legitimate Upwork communications that legitimately request callbacks; operational teams should consider corroborating signals (e.g., known trusted senders, context of the thread, or verified contact numbers) before triggering high-severity alerts. Administrators may implement whitelisting for trusted Upwork endpoints or apply additional heuristics (e.g., known customer IDs, phone number patterns) to reduce noise while preserving visibility into genuine attempts to exploit the platform for social engineering or fraud.