This rule detects potential credential phishing attempts involving Cognito Forms embedded in inbound messages. It triggers when an inbound message's HTML body matches a pattern suggesting a very short body (via a regex-based line-break heuristic) and contains a link to Cognito Forms, while the sender's email domain is not cognitoforms.com. The detection requires at least one link in the message thread whose domain is cognitoforms.com and whose display_text length exceeds 8 characters, with the display text not containing opt-out and not containing cognitoforms.com itself. Additionally, the rule excludes hits where any link's display_text matches unsubscribe, to reduce false positives from legitimate Cognito Forms usage that includes unsubscribe links. This combination aims to flag suspicious messages that attempt to lure recipients with Cognito Forms while originating from non-Cognito sender domains. Attack types: Credential Phishing. Tactics and techniques: Social engineering. Detection methods: Content analysis, Sender analysis, URL analysis. Data sources and context are aligned to inbound message inspection, with relevance to application logs and URL/domain extraction during threat analysis for endpoint or application-layer detection environments.