{"success":true,"data":{"id":"charset-downgrade-iso88591-abuse","label":"iso-8859-1 charset + base64 CTE on HTML body (encoding evasion)","description":"Encoding evasion: the email declares a legacy charset (iso-8859-1, windows-1252, or cp1252) in the Content-Type header AND uses Content-Transfer-Encoding: base64. Modern HTML email is always UTF-8; deliberately downgrading to a legacy charset combined with base64 encoding is a known technique used by spam toolkits to hide promotional keywords from UTF-8-aware content scanners. Only fires when the email body also contains tracking parameters (utm_source, utm_campaign, utm_medium), unsubscribe links, or 2+ promotional keywords (special offer, % off, limited time, etc.). Not applied to known invoice, work, or shopping senders. Score: +2.","tier":"danger","category":"other","isThin":false}}