{"success":true,"data":{"id":"body-contains-signal-contact","label":"Signal messenger link in body (move-off-email scam shape)","description":"Body contains a Signal messenger click-to-chat URL (`signal.me/` or `signal.group/`). Third member of the encrypted-chat redirect family alongside Telegram and WhatsApp. Signal is used less broadly but attracts a specific attacker subset: technical crypto scams, \"OpSec-aware\" grooming targeting journalists or dissidents, and high-value BEC follow-ups where the attacker wants E2E-encrypted continuation. The signal is URL-only — the word \"signal\" has too many legitimate uses in email prose for a word+phone pattern. Weighted at +3, matching Telegram and WhatsApp.","tier":"warning","category":"body","isThin":false}}