This rule detects inbound messages that impersonate legitimate FormAssembly notifications (e.g., order or form-response updates) but are abused to deliver scam lures pointing to attacker-controlled pages. It identifies FormAssembly-originated content (inbound messages) and looks for embedded text promoting fake priority gateways, VIP passcodes, or ticket/voucher claims designed to induce clicks. The detector uses: (1) origin check (inbound type with sender.email.domain.root_domain == 'formassembly.com') to identify FormAssembly notifications; (2) content analysis to spot promotional/scam wording; (3) URL analysis to flag suspicious or attacker-controlled links; (4) sender analysis to assess trust and impersonation signals; (5) free subdomain host detection by checking for references to free subdomains within the message body. Attack types include Spam and Credential Phishing, with tactics such as Free subdomain host usage, Social engineering, and Impersonation: Brand. This combination elevates risk when legitimate-looking notifications direct users to malicious pages. Recommended mitigations include blocking or sandboxing such messages, validating sender legitimacy, and inspecting embedded URLs for phishing indicators.