Detects inbound messages that combine conference or event terminology with hotel and reservation language, while linking to a form-building platform disguised as a legitimate booking page. The rule flags messages where an inbound thread contains a link whose root domain matches known self-service/hotel booking platforms and whose display text suggests booking (booking, booking/hotels). It also requires the thread text to include hotel/housing terms (hotels, housing, accommodations, room rates, reserve your room) and event-related terms (annual meeting, conference, congress, convention, expo, forum, seminar, summit, symposium, trade show). Sender profiles are evaluated: unsolicited or malicious/spam signals raise suspicion unless the sender is benign; if a sender is tied to highly trusted domains, DMARC must pass to override distrust. Attack types include Spam and BEC/Fraud, with a social engineering tactic focus. Detection methods encompass header analysis, sender analysis, content analysis, and URL analysis. Overall, the rule aims to detect fraudulent hotel-booking phishing that leverages event pitches to lure victims into submission forms or credential capture, while accounting for sender trust signals and DMARC authentication status.