{"success":true,"data":{"id":"encrypted-payload-no-reputation","label":"PGP/S-MIME encrypted body + weak sender auth (envelope phishing)","description":"Email body is fully encrypted via PGP (-----BEGIN PGP MESSAGE----- block) or S/MIME (Content-Type: application/pkcs7-mime; smime-type=enveloped-data) AND the sender authentication is weak (no dkim=pass, no spf=pass) AND the sender domain is not in the trusted brand allowlist. Attackers route phishing payloads through encrypted envelopes specifically because the engine cannot read the ciphertext to score body-level signals. Legitimate enterprise PGP/S-MIME senders DKIM-sign their envelope wrappers, so the auth-pass gate suppresses the signal for genuine encryption use-cases. PGP signed-only and S/MIME signed-data variants do not fire (the body remains readable).","tier":"danger","category":"other","isThin":false}}