This rule detects brand impersonation attempts targeting Anthropic/Claude via inbound messages. It triggers when the sender display name contains 'Anthropic' or 'Claude' and the sending, reply-to, or return-path domain is from a domain that was registered recently (≤90 days). It uses WHOIS to measure domain age and excludes highly trusted domains unless DMARC fails. The rule requires at least two corroborating signals from the message body, including: references to ad accounts, Claude/Anthropic ads, trial access, or subscriptions; mentions of workspace or ads teams; detection of common branding phrases; geographic postal blocks (e.g., '548 Market Street', 'San Francisco', 'CA 94104'); and NLP-derived entities for 'sender' with names containing 'Claude' or 'Anthropic' and ending with 'Team'. It also permits additional patterns like 'connect account' or 'Anthropic Team' phrases. The overall signal aims to identify social engineering and spoofing attempts via lookalike domains and impersonation while reducing false positives by DMARC checks. The rule is categorized under BEC/Fraud and Spam and uses content analysis, header analysis, sender analysis, and WHOIS data to support detection.