{"success":true,"data":{"id":"merge-tag-template-leak","label":"Unsubstituted merge-tag in production email ({{VAR}}, %VAR%, <<VAR>>, ${VAR}) — strong indicator of template-blast phishing.","description":"Unsubstituted merge-tag in production email ({{VAR}}, %VAR%, <<VAR>>, ${VAR}). When placeholder tokens appear unsubstituted, it signals a phishing template-blast or misconfigured bulk tool. Legitimate ESPs with List-Unsubscribe headers catch this; off-brand phishing tools often do not. Soft signal (+2) to allow stacking. Fires when: any merge-tag pattern detected in combined text + no In-Reply-To. Source: GE-R8; APWG phishing template analysis 2025.","tier":"warning","category":"other","isThin":false}}