{"success":true,"data":{"id":"keitaro-cloaked","label":"Keitaro TDS cloaked redirect link (click.php) combined with account-suspension urgency phishing","description":"Email contains a Keitaro TDS (Traffic Distribution System) cloaked redirect link — a click.php-style URL with TDS tracking parameters (lp=, uid=, offer_id=, aff_id=) — combined with an account-suspension urgency or credential-harvest narrative. Keitaro is a PHP-based tracker used by affiliate marketers and increasingly abused by phishing operators: the tracker serves a benign decoy to crawlers while redirecting victims to live phishing pages, bypassing reputation and sandbox checks. The signal fires when: (1) body contains a URL with /click.php? plus TDS parameters AND (2) account-action/urgency narrative is present AND (3) sender is NOT a known legitimate ESP AND (4) no List-Unsubscribe header. Source: GC1 R12 council #5; Keitaro abuse reports 2025-2026; Cofense TDS analysis 2026.","tier":"warning","category":"other","isThin":false}}