Detects inbound messages containing a Tox messenger identifier used by extortionists to coordinate extortion outside email. The rule triggers when the inbound message body (body.current_thread.text) contains a case-insensitive occurrence of the token tox (optionally prefixed with q, i.e., qtox) and a separate 76-character hexadecimal string, which together indicate a Tox ID. It excludes matches originating from known threat intel feeds (crowdstrike.com, intel471.com, recordedfuture.com) when DMARC authentication passes, to reduce false positives from intel-related traffic. Implemented as content analysis on inbound data, it targets social engineering/extortion workflows that pivot communication to an out-of-band channel. Severity is low, reflecting its role as a targeted indicator of a specific communication channel rather than a broad network compromise rule.