Detect inbound messages that spoof Coursera transactional notifications (e.g., email confirmations, account change alerts) sent from Coursera's legit sending infrastructure but aimed at recipients on newly registered domains or containing mailto links to newly registered non-Coursera domains. The rule requires the sender to appear as coursera.org and triggers when: (1) the email body contains a mailto link to a non-Coursera domain whose WHOIS age is under 365 days, and the email being changed appears in the body; or (2) the email is only present as a recipient (RCPT) and the recipient's domain is newer than 365 days. Additionally, if the body text’s first line, when run through an NLP classifier, yields a high-confidence intent named "callback_scam", the rule fires. The recipient's domain must not be part of the organization’s approved domains. Whois is used to verify domain age where applicable. The rule leverages sender analysis, URL analysis, and Whois checks to identify potential callback phishing with brand impersonation, lookalike domains, and social engineering. It is rated high severity due to risk of credential harvesting or account takeover targeting Coursera users.